Artificial intelligence agent behavior data analysis method, system, device and storage medium

Abstract

This invention discloses an AI agent behavior data analysis method, system, device, and storage medium. The method acquires multi-source behavior records of the AI ​​agent and normalizes their format. It reads the evidence storage status identifier of each multi-source behavior record and divides the multi-source behavior records into a trusted record set and a special record set based on the evidence storage status identifier. It then uses a correction factor to correct the compliance quantification value. The method performs post-adjustment on the preliminary analysis results, calculates the deviation of the preliminary analysis results from the dynamic group baseline score, and outputs a standardized trusted analysis signal. When a dynamic group baseline score is generated, the standardized trusted analysis signal also includes the deviation. This method can improve the objectivity and adaptability of the analysis results, enhance the scalability, horizontal comparability, and standardization of the output signal of AI agent behavior analysis, thereby providing downstream systems with more accurate, reliable, and group-dimensional reference value for trusted quantification.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, system, device, and storage medium for analyzing AI agent behavior data. Background Technology

[0002] With the large-scale deployment of Artificial Intelligence (AI) agent technology, AI agents with autonomous planning, tool invocation, and cross-platform collaboration capabilities have been widely applied in various business scenarios such as finance, customer service, manufacturing, and transportation.

[0003] How to accurately and reliably evaluate the credibility of the behavior of each AI agent has become a core technical issue in AI ecosystem governance.

[0004] Existing AI agent behavior data processing solutions generally suffer from the following technical shortcomings: (i) Lack of a unified processing framework for multi-source heterogeneous data Existing solutions lack a unified format normalization processing mechanism for behavioral data from different data sources (including behavioral logs, evidence records, external feedback data, external judgment data, etc.). They typically only process a single type of data source and cannot integrate multi-source heterogeneous data into consistent behavioral records, resulting in a large amount of valuable data not being systematically included in the analysis.

[0005] (ii) Lack of prior verification of the credibility of data sources Existing solutions directly read data from behavior logs for analysis without verifying the authenticity and completeness of the behavior records themselves. Once the behavior logs are tampered with or deleted, the analysis results will be completely distorted. In particular, for AI agents deployed in open environments, behavior logs may be damaged due to system vulnerabilities, malicious attacks, or operational errors. Existing solutions lack effective identification and handling mechanisms for such situations.

[0006] (iii) Lack of a unified processing entry point for external special data Existing solutions lack a unified processing entry point for non-standard data such as abnormal evidence storage data and judgment results returned from external systems. They are usually ignored or processed separately, and cannot be systematically transformed into standardized inputs for credible analysis.

[0007] (iv) Lack of systematic post-adjustment and group reference for analysis results Existing solutions end the processing flow after outputting the analysis results, lacking a post-processing adjustment mechanism for the results: including handling insufficient data in cold start scenarios, confidence correction of cumulative data volume, relative positioning of the group, and determination of time-series trends; moreover, they lack the ability to compare the behavioral data of a single agent within the distribution of similar agents, and cannot provide quantitative information such as "where the behavioral data of this agent is located among similar agents".

[0008] (v) Lack of scalable output signal format Existing solutions output "analysis reports" or "scoring results" instead of standardized data signals that can be directly used by downstream systems, resulting in poor reusability and interoperability of analysis results.

[0009] (vi) Lack of a unified reference system across domains and scenarios Existing solutions are all closed-loop evaluations deployed within a single platform. There is no technical solution that can achieve unified comparison of agent behavior data across different cloud environments and different business ecosystems, resulting in a lack of objective behavioral comparison benchmarks in cross-domain collaboration scenarios. Summary of the Invention

[0010] The main objective of this invention is to provide an AI agent behavior data analysis method, system, device, and storage medium, aiming to solve the technical problems in existing AI agent behavior analysis, such as unreliable data sources, ineffective integration of external heterogeneous data, and lack of group reference system, which lead to biased evaluation results and low accuracy and reliability.

[0011] In a first aspect, the present invention provides an AI agent behavior data analysis method, the AI ​​agent behavior data analysis method comprising the following steps: The AI ​​agent acquires multi-source behavior records and performs format normalization. The evidence storage status identifier of each multi-source behavior record is read. Based on the evidence storage status identifier, the multi-source behavior records are divided into a trusted record set and a special record set. The special record set and external special data are uniformly converted into standardized correction factors. The performance quantification value and compliance quantification value are calculated based on the trusted record set. The compliance quantification value is corrected using the correction factor. The corrected compliance quantification value and the performance quantification value are then combined according to a preset fusion rule to generate preliminary analysis results. The preliminary analysis results are then adjusted. When the group data of similar intelligent agents meet the preset conditions, a dynamic group baseline score is generated based on the group data of similar intelligent agents. The deviation of the preliminary analysis results from the dynamic group baseline score is calculated, and a standardized reliable analysis signal is output. The standardized reliable analysis signal includes at least a reliable quantization value. When the dynamic group baseline score is generated, the standardized reliable analysis signal also includes the deviation.

[0012] Optionally, the step of acquiring multi-source behavior records of the AI ​​agent and normalizing their format, reading the evidence storage status identifier of each multi-source behavior record, dividing the multi-source behavior records into a trusted record set and a special record set based on the evidence storage status identifier, and uniformly converting the special record set and external special data into a standardized correction factor includes: Behavior records are collected from multiple data sources, and the behavior records with different input formats are uniformly mapped to the standard behavior record format inside the system. The evidence storage status is identified as complete, broken, or pending verification. Complete evidence-preserving behavior records are classified into the trusted record set, while fragmented evidence-preserving behavior records and evidence-preserving behavior records awaiting verification are classified into the special record set. The stored and verified behavior records are sent to an asynchronous verification queue for asynchronous processing, wherein the asynchronous processing is executed independently of the main process; Obtain the data type and severity level of the special record set and external special data, and generate corresponding correction factors according to the data type and severity level in accordance with preset mapping rules.

[0013] Optionally, the step of collecting behavior records from multiple data sources and mapping the collected behavior records in different input formats to a standard behavior record format within the system includes: Behavior records are collected from multiple data sources, and the behavior records with different input formats are normalized and uniformly mapped to the standard behavior record format inside the system. When there are conflicting violation types in the behavior records from different data sources, violation type conflict arbitration is performed; When multiple conflicting markers exist, the marker with the highest risk level is selected as the final decision.

[0014] Optionally, after sending the stored behavior record to be verified into the asynchronous verification queue for asynchronous processing, the AI ​​agent behavior data analysis method further includes: After asynchronous verification is completed, if the verification result is that the evidence is intact, the corresponding behavior record will be re-included in the trusted record set; if the verification result is that the evidence is broken, the corresponding behavior record will be re-included in the special record set, and the generation of correction factors will be triggered.

[0015] Optionally, the step of calculating the performance quantification value and compliance quantification value based on the trusted record set, correcting the compliance quantification value using the correction factor, and generating preliminary analysis results by combining the corrected compliance quantification value and the performance quantification value according to a preset fusion rule includes: The task completion rate and quality score of the trusted record set are statistically analyzed, and the performance quantification value is calculated using the short board constraint aggregation rule, which is to take the minimum value between the task completion rate and the normalized value of the quality score. Extract violation records from the trusted record set and determine the violation type, using a preset full score as the initial value; A compliance quantification value is obtained by gradient deduction based on the mapping relationship between the violation type and the deduction value, wherein the deduction value is positively correlated with the risk level of the system resource call chain represented by the violation type; The compliance quantification value is corrected using the correction factor, and the corrected compliance quantification value is fused with the performance quantification value through adaptive weighting to generate preliminary analysis results.

[0016] Optionally, before obtaining the compliance quantification value by performing gradient deduction based on the mapping relationship between the violation type and the deduction value, the AI ​​agent behavior data analysis method further includes: Based on the statistical distribution of historical violation data, automatic clustering is used to generate a mapping relationship between each deduction value and each violation type; Alternatively, the system administrator can configure the mapping relationship between each deduction value and each violation type in the compliance management module.

[0017] Optionally, the step of correcting the compliance quantification value using the correction factor and then fusing the corrected compliance quantification value with the performance quantification value through adaptive weighting to generate preliminary analysis results includes: The compliance quantification value is adjusted by deducting the correction factor to obtain the corrected compliance quantification value. The performance quantification value and the corrected compliance quantification value are fused using adaptive weighting to generate preliminary analysis results; wherein, when the corrected compliance quantification value is lower than a preset compliance threshold, the weight coefficient of the compliance dimension is automatically increased, and the weight coefficient has an upper limit cutoff value.

[0018] Optionally, the preliminary analysis results are post-adjusted. When the group data of similar intelligent agents meets preset conditions, a dynamic group baseline score is generated based on the group data of similar intelligent agents, and the deviation of the preliminary analysis results from the dynamic group baseline score is calculated. A standardized reliable analysis signal is output, wherein the standardized reliable analysis signal includes at least a reliable quantization value. When the dynamic group baseline score is generated, the standardized reliable analysis signal also includes the deviation, including: The preliminary analysis results are processed by a post-adjustment engine, which performs at least one of the following post-adjustments, wherein the post-adjustment engine includes at least one of the following sub-engines: a data insufficiency processing sub-engine, a confidence factor sub-engine, a group relative positioning sub-engine, and a trend analysis sub-engine. When the data volume of the preliminary analysis result is lower than a preset threshold, the quantized value after smooth transition is generated by the insufficient data processing sub-engine, which is used as the input benchmark for subsequent sub-engines; After generating the quantized value, confidence labeling is performed on the quantized value by the confidence factor sub-engine, without changing the quantized value itself; Generating a dynamic group baseline score based on group data of similar agents; After the dynamic group baseline score is generated, the deviation degree of the preliminary analysis result relative to the dynamic group baseline score is calculated by the group relative positioning sub-engine, and a standardized credible analysis signal is output without changing the quantized value itself, wherein the standardized credible analysis signal at least comprises a credible quantized value; When trend analysis is required, the trend slope is calculated by the trend analysis sub-engine, without changing the quantized value itself; The outputs of all sub-engines are independently presented in different fields in the standardized credible analysis signal; When the dynamic group baseline score is generated, the standardized credible analysis signal further comprises the deviation degree.

[0019] Optionally, that the quantized value after smooth transition is generated by the insufficient data processing sub-engine when the data volume of the preliminary analysis result is lower than a preset threshold, which is used as the input benchmark for subsequent sub-engines, comprises: When the data volume of the preliminary analysis result is lower than the preset threshold, the current number of behavior events M is acquired by the insufficient data processing sub-engine, and preset first transition threshold T1 and second transition threshold T2 are acquired, where T1<T2; When M≤T1, the quantized value after smooth transition directly adopts the initial baseline value; When T1<M<T2, the quantized value after smooth transition is calculated by the following formula:

[0020] wherein, is the quantized value, is the initial baseline value, is the actual calculated value, is the smooth transition coefficient, which monotonically increases with M; When M≥T2, the quantized value after smooth transition directly adopts the actual calculated value.

[0021] Optionally, that after generating the quantized value, confidence labeling is performed on the quantized value by the confidence factor sub-engine without changing the quantized value itself, comprises: After generating the quantified value, a confidence factor is generated based on the cumulative data volume, wherein the confidence factor is positively correlated with the cumulative data volume, and the cumulative data volume is the total number of behavioral records in the trusted record set; When the cumulative data volume is lower than a preset data volume threshold, the confidence factor is lower than a preset confidence threshold; The confidence factor scoring engine is used to label the quantified value with confidence. The confidence label is presented as an independent field in the standardized credible analysis signal without changing the quantified value itself.

[0022] Optionally, the generation of dynamic group baseline scores based on group data of similar intelligent agents includes: The AI ​​agent is identified as belonging to the same category as the AI ​​agent according to a preset classification strategy. When the sample size of the dimension combination in the query conditions is insufficient, the data is automatically reverted to the baseline data of the higher-level dimension. The preset classification strategy includes at least one of the following: classification by task type, classification by application scenario, and classification by function category. Historical behavior data of each similar intelligent agent is collected from the group of intelligent agents, and statistical characteristics of the behavior quantification values ​​corresponding to the historical behavior data are calculated. The statistical characteristics include at least one of mean, median, standard deviation, and quantile. A dynamic population baseline score is generated based on the statistical characteristics. The dynamic population baseline score is continuously accumulated and updated as the system runs, so as to form a dynamically evolving reference system. Determine whether the number of similar agent samples under the currently selected combination of classification dimensions meets the preset quantity requirement; When the number of similar intelligent agent samples does not meet the preset quantity requirement, it automatically reverts to the baseline data of the higher dimension.

[0023] Optionally, after the dynamic population baseline score is generated, the deviation of the preliminary analysis result from the dynamic population baseline score is calculated by the population relative positioning score engine, and a standardized reliable analysis signal is output without changing the quantization value itself, including: After the dynamic group baseline score is generated, the preliminary analysis result is compared with the dynamic group baseline score through the group relative positioning score engine. The deviation of the preliminary analysis result relative to the dynamic group baseline score is calculated based on the comparison result. The deviation is used to characterize the relative position of the AI ​​agent's behavior level in a group of similar agents. The deviation is output as an independent field to a standardized confidence analysis signal, wherein the quantization value in the standardized confidence analysis signal remains unchanged.

[0024] Optionally, after outputting the deviation as an independent field to the standardized reliable analysis signal, the AI ​​agent behavior data analysis method further includes: Through a standardized external data interface, the trusted analysis node corresponding to the standardized trusted analysis signal is synchronized with other nodes according to a preset synchronization strategy, and data from other nodes is received to correct the local reference system. The nodes are interconnected through the standardized data flow interface to form a distributed data processing network, which is used to exchange group baseline data to generate a cross-domain global reference system.

[0025] Optionally, when trend analysis is required, calculating the trend slope through the trend analysis engine without changing the quantified value itself includes: When trend analysis is required, time series analysis result data is obtained through the trend analysis sub-engine. The time series analysis result data is a quantified value sequence of the preliminary analysis result at multiple time points. A trend trajectory is generated based on the time series analysis results, and the trend slope is calculated using sliding window linear regression. The trend direction and trend level are output according to a preset slope threshold range, wherein the trend direction includes at least one of rising, falling or stable. The trend direction and the trend level are output as independent fields to the standardized confidence analysis signal, and the quantized value in the standardized confidence analysis signal remains unchanged.

[0026] Optionally, when the dynamic population baseline score is generated, the standardized confidence analysis signal further includes the deviation, comprising: When the dynamic population baseline score is generated, the standardized credibility analysis signal, in addition to including the credibility quantification value, also fills the deviation field with the deviation degree; wherein, the deviation degree field is one of the preset fields in the standardized credibility analysis signal, and the standardized credibility analysis signal adopts a fixed field format and includes all preset fields; When the dynamic population baseline score is not generated, the deviation field is filled with a null value or a preset value, and the other fields in the standardized confidence analysis signal are unaffected.

[0027] Optionally, before generating the dynamic group baseline score based on group data of similar intelligent agents, the AI ​​agent behavior data analysis method further includes: When the dynamic group baseline score cannot be generated, an individual behavior baseline is generated based on the historical behavior data of the AI ​​agent, and the individual deviation of the preliminary analysis result relative to the individual behavior baseline is calculated. The standardized reliable analysis signal also includes an individual deviation field relative to the individual behavior baseline.

[0028] Optionally, the trusted quantification value is a numerical representation of the AI ​​agent's behavioral level, calculated based on the trusted record set.

[0029] Secondly, to achieve the above objectives, the present invention also proposes an AI agent behavior data analysis system, the AI ​​agent behavior data analysis system comprising: The trusted data acquisition engine is configured to acquire multi-source behavior records of AI agents from multiple data sources, normalize the format of the multi-source behavior records, read the evidence storage status identifier of each multi-source behavior record, and divide the multi-source behavior records into a trusted record set and a special record set according to the evidence storage status identifier. A special data processing engine is configured to receive the special record set and external special data received through a standardized external data interface, and to uniformly convert the special record set and the external special data into a standardized correction factor. An automated calculation engine is configured to receive the trusted record set and the correction factor, calculate the performance quantification value and the compliance quantification value based on the trusted record set, correct the compliance quantification value using the correction factor, and generate preliminary analysis results by combining the corrected compliance quantification value and the performance quantification value according to a preset fusion rule. The post-adjustment engine is configured to receive the preliminary analysis results, perform post-adjustment on the preliminary analysis results, generate a dynamic group baseline score based on the group data of the same type of intelligent agents when the group data of the same type of intelligent agents meets the preset conditions, calculate the deviation of the preliminary analysis results from the dynamic group baseline score, and output a standardized reliable analysis signal. The standardized reliable analysis signal includes at least a reliable quantization value. When the dynamic group baseline score is generated, the standardized reliable analysis signal also includes the deviation.

[0030] Thirdly, to achieve the above objectives, the present invention also proposes an AI agent behavior data analysis device, which includes: a memory, a processor, and an AI agent behavior data analysis program stored in the memory and executable on the processor. The AI ​​agent behavior data analysis program is configured to implement the steps of the AI ​​agent behavior data analysis method described above.

[0031] Fourthly, to achieve the above objectives, the present invention also proposes a storage medium storing an AI agent behavior data analysis program, wherein the AI ​​agent behavior data analysis program, when executed by a processor, implements the steps of the AI ​​agent behavior data analysis method described above.

[0032] The AI ​​agent behavior data analysis method proposed in this invention acquires multi-source behavior records of AI agents and normalizes their format. It reads the evidence storage status identifier of each multi-source behavior record, divides the multi-source behavior records into a trusted record set and a special record set based on the evidence storage status identifier, and uniformly transforms the special record set and external special data into a standardized correction factor. Based on the trusted record set, it calculates performance quantification values ​​and compliance quantification values, corrects the compliance quantification value using the correction factor, and generates a preliminary analysis result by fusing the corrected compliance quantification value and the performance quantification value according to a preset fusion rule. The preliminary analysis result is then post-adjusted. When the group data of similar AI agents meets preset conditions, a dynamic group baseline score is generated based on the group data of similar AI agents, and the deviation of the preliminary analysis result from the dynamic group baseline score is calculated. A standardized trusted analysis signal is output, which includes at least a trusted quantification value. When the dynamic group baseline is generated... In the time-sharing model, the standardized credible analysis signal also includes the deviation degree; it can distinguish credible records from special records through evidence status identifiers and standardize external special data into correction factors, effectively solving the problems of unreliable data sources and inability to integrate external heterogeneous data in existing technologies for AI agent behavior analysis; by calculating performance quantification values ​​and compliance quantification values ​​based on credible record sets, and combining correction factors and adaptive fusion rules to generate preliminary analysis results, the evaluation logic takes into account multi-dimensional dynamic behavioral characteristics, improving the objectivity and adaptability of the analysis results; by performing post-adjustments on the preliminary analysis results, including dynamic group baseline scores and deviation degree calculations, a credible analysis signal output mechanism with a group reference system is constructed, effectively making up for the lack of horizontal comparison references for single agent data, significantly improving the scalability, horizontal comparability, and standardization of output signals of AI agent behavior analysis, thereby providing downstream systems with more accurate, reliable, and credible quantitative basis with group dimension reference value. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of the device structure of the hardware operating environment involved in the embodiments of the present invention; Figure 2 This is a flowchart illustrating the first embodiment of the AI ​​intelligent agent behavior data analysis method of the present invention; Figure 3 This is a flowchart illustrating the second embodiment of the AI ​​intelligent agent behavior data analysis method of the present invention; Figure 4 This is a flowchart illustrating the third embodiment of the AI ​​intelligent agent behavior data analysis method of the present invention; Figure 5 This is a flowchart illustrating the fourth embodiment of the AI ​​intelligent agent behavior data analysis method of the present invention; Figure 6 This is a functional block diagram of the first embodiment of the AI ​​intelligent agent behavior data analysis system of the present invention.

[0034] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0035] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0036] In the various embodiments of the present invention, unless otherwise explicitly stated, the various thresholds (including but not limited to data volume threshold, confidence threshold, deviation threshold, and weight upper limit cutoff value), time windows (including but not limited to verification window period and trend analysis window), sampling period, weight coefficient, and level classification standards (including but not limited to credibility level, trend level, and confidence level) involved in the method steps are all configuration items that can be preset or dynamically adjusted by the system according to the application scenario.

[0037] Those skilled in the art can reasonably configure the above parameters according to the data characteristics, business requirements and operating environment of specific application scenarios without changing the core inventive concept of the present invention.

[0038] Similarly, the conflict arbitration method for multi-source data fusion, the mapping rule for format normalization, the calculation method for adaptive weight fusion, and the multi-dimensional aggregation strategy for group baseline scores are all preferred implementation methods that can be selected by the system according to the deployment scenario, rather than limitations on the scope of protection of this invention.

[0039] The solution of this invention mainly involves: acquiring multi-source behavior records of AI agents and normalizing their format; reading the evidence storage status identifier of each multi-source behavior record; dividing the multi-source behavior records into a trusted record set and a special record set based on the evidence storage status identifier; and uniformly converting the special record set and external special data into a standardized correction factor; calculating the performance quantification value and compliance quantification value based on the trusted record set; correcting the compliance quantification value using the correction factor; and generating a preliminary analysis result by fusing the corrected compliance quantification value and the performance quantification value according to a preset fusion rule; performing a post-adjustment on the preliminary analysis result; generating a dynamic group baseline score based on the group data of similar AI agents when the group data of similar AI agents meets preset conditions; calculating the deviation of the preliminary analysis result from the dynamic group baseline score; and outputting a standardized trusted analysis signal, which includes at least a trusted quantification value. When the dynamic group baseline score is generated, the standardized trusted analysis signal also includes the deviation. This allows for the differentiation of trusted records by evidence storage status identifier. This approach records and standardizes external special data into correction factors, effectively addressing the problems of unreliable data sources and the inability to integrate heterogeneous external data in existing AI agent behavior analysis technologies. By calculating performance and compliance quantification values ​​based on a reliable record set, and combining correction factors and adaptive fusion rules to generate preliminary analysis results, the evaluation logic takes into account multi-dimensional dynamic behavioral characteristics, improving the objectivity and adaptability of the analysis results. By performing post-adjustments on the preliminary analysis results, including dynamic group baseline scores and deviation calculations, a reliable analysis signal output mechanism with a group reference system is constructed. This effectively compensates for the lack of horizontal comparison references for single agent data, significantly improving the scalability, horizontal comparability, and standardization of output signals in AI agent behavior analysis. This provides downstream systems with more accurate, reliable, and reliable quantitative evidence with group-dimensional reference value, solving the technical problems of unreliable data sources, ineffective integration of heterogeneous external data, and lack of a group reference system in existing AI agent behavior analysis technologies, which result in biased, inaccurate, and unreliable evaluation results.

[0040] Reference Figure 1 , Figure 1 This is a schematic diagram of the device structure of the hardware operating environment involved in the embodiments of the present invention.

[0041] like Figure 1As shown, the device may include: a processor 1001, such as a CPU; a communication bus 1002; a user interface 1003; a network interface 1004; and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen or an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or non-volatile memory, such as a disk drive. Optionally, the memory 1005 may also be a storage system independent of the aforementioned processor 1001.

[0042] Those skilled in the art will understand that Figure 1 The device structure shown does not constitute a limitation on the device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0043] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating system, a network communication module, a user interface module, and an AI agent behavior data analysis program.

[0044] The device of the present invention calls the AI ​​agent behavior data analysis program stored in the memory 1005 through the processor 1001, and performs the operations as described in the above embodiment of the AI ​​agent behavior data analysis method.

[0045] Based on the above hardware structure, an embodiment of the AI ​​agent behavior data analysis method of the present invention is proposed.

[0046] Reference Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the AI ​​agent behavior data analysis method of the present invention.

[0047] In the first embodiment, the AI ​​agent behavior data analysis method includes the following steps: Step S10: Obtain multi-source behavior records of the AI ​​agent and normalize the format; read the evidence storage status identifier of each multi-source behavior record; divide the multi-source behavior records into a trusted record set and a special record set according to the evidence storage status identifier; and uniformly convert the special record set and external special data into a standardized correction factor.

[0048] It should be noted that the process involves acquiring multi-source behavior records of the AI ​​agent and normalizing their format to convert behavior records from different sources into a unified standard format. The evidence storage status identifier of each multi-source behavior record is read, and based on the data credibility status represented by the evidence storage status identifier, the multi-source behavior records are divided into a credible record set and a special record set. The special record set and external special data are then uniformly converted into standardized correction factors for subsequent correction of compliance quantification values.

[0049] Step S20: Calculate the performance quantification value and compliance quantification value based on the trusted record set, correct the compliance quantification value using the correction factor, and generate preliminary analysis results by combining the corrected compliance quantification value and the performance quantification value according to a preset fusion rule.

[0050] It should be understood that the performance quantification value and compliance quantification value are calculated based on the trusted record set, wherein the performance quantification value is used to characterize the level of task completion and the compliance quantification value is used to characterize the degree of violation. The compliance quantification value is corrected using the correction factor to incorporate the impact of special risk data, and the corrected compliance quantification value and the performance quantification value are weighted or combined according to the preset fusion rules to generate preliminary analysis results.

[0051] Step S30: Perform post-adjustment on the preliminary analysis results. When the group data of similar intelligent agents meet the preset conditions, generate a dynamic group baseline score based on the group data of similar intelligent agents, calculate the deviation of the preliminary analysis results from the dynamic group baseline score, and output a standardized credible analysis signal. The standardized credible analysis signal includes at least a credible quantization value. When the dynamic group baseline score is generated, the standardized credible analysis signal also includes the deviation.

[0052] Understandably, the preliminary analysis results are adjusted post-processed to ensure that the results are corrected and supplemented in multiple dimensions before output. When the group data of similar intelligent agents meet the preset conditions, a dynamic group baseline score is generated based on the group data of similar intelligent agents. The preliminary analysis results are then compared with this dynamic group baseline score to calculate the deviation of the preliminary analysis results from the dynamic group baseline score. This provides a group-level reference for subsequent output and outputs a standardized reliable analysis signal. This signal contains at least a reliable quantification value, and the deviation is additionally included in the standardized reliable analysis signal only when a dynamic group baseline score has been generated, to ensure the integrity of the output fields and the uniformity of the signal format.

[0053] It should be noted that the group baseline score in this embodiment refers to a reference system generated based on the statistical characteristics of the quantitative values ​​of the behavior of similar intelligent agents. This reference system includes, but is not limited to, the mean, median, standard deviation, and quantiles of the quantitative values ​​of the behavior of similar intelligent agents. "Similar" refers to the classification of intelligent agent groups automatically divided by the system according to the technical characteristics of the intelligent agents, such as task type, application scenario, and functional category. The group baseline score is continuously accumulated and updated as the system runs, forming a dynamically evolving reference system. The standardized trustworthy analysis signal refers to the structured data output after system processing, which includes at least fields such as trustworthy quantitative value, trustworthy level, group baseline score, and deviation. This signal is encapsulated in a standardized data format and can be directly called by downstream systems through the data interface. The group baseline score is an optional enhancement function of this invention, not a prerequisite for system operation. When the group baseline score cannot be generated due to insufficient sample size, data sovereignty restrictions, or lack of authorization, the system can still independently complete the behavioral trustworthy analysis through the basic data processing logic of each engine and output the standardized trustworthy analysis signal.

[0054] In its specific implementation, the standardized trusted analysis signal adopts a fixed field format, which includes all preset fields. When a certain sub-engine is not enabled by the system, the field corresponding to that sub-engine is filled with null values ​​or preset default values ​​to ensure the uniformity of the data format and the stability of the downstream system's parsing. All preset fields include at least the trusted quantification value, trusted level, group baseline score, deviation, trend label, warning level, and confidence label.

[0055] This embodiment, through the above scheme, acquires multi-source behavior records of AI agents and performs format normalization. It reads the evidence storage status identifier of each multi-source behavior record, divides the multi-source behavior records into a trusted record set and a special record set based on the evidence storage status identifier, and uniformly transforms the special record set and external special data into a standardized correction factor. Based on the trusted record set, it calculates the performance quantification value and the compliance quantification value, uses the correction factor to correct the compliance quantification value, and generates a preliminary analysis result by fusing the corrected compliance quantification value and the performance quantification value according to a preset fusion rule. The preliminary analysis result is then post-adjusted. When the group data of similar AI agents meets preset conditions, a dynamic group baseline score is generated based on the group data of similar AI agents, and the deviation of the preliminary analysis result from the dynamic group baseline score is calculated. A standardized trusted analysis signal is output, which includes at least a trusted quantification value. When the dynamic group baseline score is generated, the... The standardized credible analysis signal also includes the deviation; it can distinguish between credible records and special records through evidence status identifiers, and standardize external special data into correction factors, effectively solving the problems of unreliable data sources and inability to integrate heterogeneous external data in existing technologies for AI agent behavior analysis; by calculating performance quantification values ​​and compliance quantification values ​​based on credible record sets, and combining correction factors and adaptive fusion rules to generate preliminary analysis results, the evaluation logic takes into account multi-dimensional dynamic behavioral characteristics, improving the objectivity and adaptability of the analysis results; by performing post-adjustments on the preliminary analysis results, including dynamic group baseline scores and deviation calculations, a credible analysis signal output mechanism with a group reference system is constructed, effectively making up for the lack of horizontal comparison references for single agent data, significantly improving the scalability, horizontal comparability, and standardization of output signals of AI agent behavior analysis, thereby providing downstream systems with more accurate, reliable, and credible quantitative basis with group dimension reference value.

[0056] Furthermore, Figure 3 This is a flowchart illustrating the second embodiment of the AI ​​agent behavior data analysis method of the present invention, as shown below. Figure 3 As shown, based on the first embodiment, a second embodiment of the AI ​​agent behavior data analysis method of the present invention is proposed. In this embodiment, step S10 specifically includes the following steps: Step S11: Collect behavior records from multiple data sources and map the collected behavior records in different input formats to the standard behavior record format within the system.

[0057] It should be noted that behavior records are collected from multiple data sources, and these behavior records with different input formats are uniformly mapped to the system's internal standard behavior record format. This eliminates data inconsistencies caused by format differences between different data sources, ensuring that behavior records from each data source have unified field definitions, data types, and structural specifications before entering subsequent processing flows.

[0058] Furthermore, step S11 specifically includes the following steps: Behavior records are collected from multiple data sources, and the behavior records with different input formats are normalized and uniformly mapped to the standard behavior record format inside the system. When there are conflicting violation types in the behavior records from different data sources, violation type conflict arbitration is performed; When multiple conflicting markers exist, the marker with the highest risk level is selected as the final decision.

[0059] It should be understood that after collecting behavioral records from multiple data sources, the records with different input formats are normalized and uniformly mapped to the standard format within the system. At the same time, if different data sources have conflicting labels for the same behavioral record's violation type, conflict arbitration is performed, and when multiple conflicting labels exist, the label with the highest risk level is selected as the final ruling to ensure that the violation data used for subsequent analysis is consistent and the most stringent.

[0060] Step S12: Identify the evidence storage status as complete, broken, or pending verification.

[0061] It is understood that identifying the evidence storage status as complete, broken, or pending verification involves parsing the evidence storage status identifier attached to each multi-source behavior record to determine the current evidence storage status of that record. Among them, complete evidence storage indicates that the credibility of the record has been verified, broken evidence storage indicates that the evidence storage link of the record is missing, and pending verification indicates that the record is still in a state of pending verification. This identification result provides a basis for subsequent determination of whether the behavior record is classified into a trusted record set or a special record set.

[0062] Understandably, the evidence storage status identifier refers to the status mark generated by the system's internal evidence storage verification module after verifying the integrity of the evidence storage chain for each multi-source behavior record. It includes three statuses: "evidence storage complete", "evidence storage broken", and "evidence storage pending verification". This identifier is independent of the behavior record content itself and is used to drive subsequent data diversion processing.

[0063] Step S13: Classify the complete evidence-preserving behavior records into the trusted record set, and classify the fragmented evidence-preserving behavior records and the evidence-preserving behavior records pending verification into the special record set.

[0064] It should be understood that behavior records with complete evidence are classified into the trusted record set, while behavior records with broken evidence or evidence pending verification are classified into the special record set. That is, behavior records are divided according to the determination result of the evidence status in order to distinguish trusted data from data to be processed, so that subsequent calculations are only performed based on the trusted record set, while the special record set enters an additional transformation process.

[0065] Step S14: Send the stored evidence-to-be-verified behavior record into the asynchronous verification queue for asynchronous processing, wherein the asynchronous processing is executed independently of the main process.

[0066] It is understandable that the evidence-based behavior records to be verified are sent to the asynchronous verification queue for asynchronous processing. That is, the execution of the main process is not blocked. Instead, the records to be verified are temporarily isolated in an independent queue. After the asynchronous verification is completed, the records to be verified are returned to the trusted record set or the special record set according to the verification results. This ensures that the processing of the records to be verified does not block the main process calculation based on the trusted record set, while still ensuring the integrity of the data credibility determination.

[0067] Furthermore, after step S14, the AI ​​agent behavior data analysis method further includes the following steps: After asynchronous verification is completed, if the verification result is that the evidence is intact, the corresponding behavior record will be re-included in the trusted record set; if the verification result is that the evidence is broken, the corresponding behavior record will be re-included in the special record set, and the generation of correction factors will be triggered.

[0068] It should be noted that after asynchronous verification is completed, the behavior records temporarily stored in the asynchronous queue can be redirected according to the verification results: if the verification result determines that the evidence is complete, the behavior record is merged into the trusted record set and included in the subsequent calculation path based on the trusted record set; if the verification result determines that the evidence is broken, the behavior record is reassigned to the special record set, and the correction factor generation operation for the record is triggered synchronously to introduce its risk impact into the subsequent compliance correction process.

[0069] Step S15: Obtain the data type and severity level of the special record set and external special data, and generate corresponding correction factors according to the data type and severity level in accordance with preset mapping rules.

[0070] It should be understood that the special record set and the external special data each carry a data type and a severity level. The data type and severity level are obtained and used as mapping inputs. The special record set and the external special data are converted into corresponding correction factors according to preset mapping rules so that they can participate in the subsequent correction calculation of compliance quantification values ​​in a unified quantitative form.

[0071] This embodiment, through the above-described scheme, collects behavioral records from multiple data sources and maps these records, which have different input formats, to a unified standard behavioral record format within the system; identifies the evidence storage status as complete, fragmented, or pending verification; categorizes complete behavioral records into a trusted record set, and fragmented and pending verification records into a special record set; sends the pending verification records to an asynchronous verification queue for asynchronous processing, where the asynchronous processing is independent of the main process; acquires the data type and severity level of the special record set and external special data, and generates corresponding correction factors according to the data type and severity level based on preset mapping rules; and eliminates format differences between multi-source data through format normalization, providing consistent data for subsequent unified processing. Based on this, by identifying the evidence storage status identifier and classifying the behavior records of complete evidence storage, broken evidence storage, and evidence storage pending verification into trusted record sets or special record sets respectively, the system achieves effective separation of trusted data and data to be processed, ensuring that subsequent calculations are performed only based on trusted record sets. Simultaneously, the behavior records of evidence storage pending verification are sent to an asynchronous verification queue for asynchronous processing independent of the main process, preventing the data to be verified from blocking the main process and improving data processing efficiency. Furthermore, by acquiring the data type and severity level of special record sets and external special data, and generating standardized correction factors according to preset mapping rules, the system enables broken evidence storage data and external special data to be integrated into subsequent compliance correction calculations in a unified quantitative form. This effectively solves the technical problem of the inability to effectively integrate heterogeneous external data in existing technologies, improving the reliability of data sources and the accuracy of analysis results.

[0072] Furthermore, Figure 4 This is a flowchart illustrating the third embodiment of the AI ​​agent behavior data analysis method of the present invention, as shown below. Figure 4 As shown, based on the first embodiment, a third embodiment of the AI ​​intelligent agent behavior data analysis method of the present invention is proposed. In this embodiment, step S20 specifically includes the following steps: Step S21: Calculate the task completion rate and quality score of the trusted record set, and use the short-board constraint aggregation rule to calculate the performance quantification value. The short-board constraint aggregation rule is to take the minimum value between the task completion rate and the normalized value of the quality score.

[0073] It should be noted that the task completion rate and quality score of the aforementioned trusted record set are statistically analyzed, and the performance quantification value is calculated using the weakest constraint aggregation rule. That is, the minimum value between the task completion rate and the normalized value of the quality score is taken as the performance quantification value. In this way, the "barrel effect" constraint logic incorporates the two dimensions of task completion quantity and completion quality into the same evaluation framework, so that the overall performance level is limited by the weaker dimension of the two, avoiding the overly high value of one indicator from masking the deficiency of the other dimension, and reflecting the real performance capability of the agent in a more rigorous and balanced way.

[0074] Step S22: Extract violation records from the trusted record set and determine the violation type, using a preset full score as the initial value.

[0075] It is understandable that violation records are extracted from the trusted record set and their violation types are determined. At the same time, a preset full score is used as the initial value to provide a unified starting benchmark for subsequent gradient deduction based on the deduction mapping relationship corresponding to the violation type.

[0076] Step S23: Obtain a compliance quantification value by performing gradient deduction based on the mapping relationship between the violation type and the deduction value, wherein the deduction value is positively correlated with the risk level of the system resource call chain represented by the violation type.

[0077] It should be understood that by obtaining the deduction value corresponding to the violation type, and based on the preset mapping relationship between the violation type and the deduction value, gradient deduction is performed with the preset full score as the initial value. The deduction value corresponding to the violation type is reduced item by item until all violation records in the trusted record set are processed, and finally a compliance quantification value is obtained. The deduction value is positively correlated with the risk level of the system resource call chain represented by the violation type. That is, the higher the risk level of the system resource call chain corresponding to the violation type, the larger the deduction value, so that high-risk violations are subject to stronger deduction constraints in the compliance quantification value, thereby improving the sensitivity and distinguishability of the compliance quantification value to system security risks.

[0078] Furthermore, prior to step S23, the AI ​​agent behavior data analysis method further includes the following steps: Based on the statistical distribution of historical violation data, automatic clustering is used to generate a mapping relationship between each deduction value and each violation type; Alternatively, the system administrator can configure the mapping relationship between each deduction value and each violation type in the compliance management module.

[0079] It should be noted that the mapping relationship between each deduction value and each violation type can be automatically generated by clustering based on the statistical distribution of historical violation data, or the mapping relationship between each deduction value and each violation type can be configured by the system administrator in the compliance management module. Among them, the automatic clustering method automatically summarizes the deduction criteria by analyzing the distribution pattern of historical violation data, reducing manual intervention and improving the objectivity of the mapping relationship, while the administrator configuration method allows manual setting of deduction criteria according to specific business needs. Both methods together provide a flexible and adaptable mapping relationship generation mechanism.

[0080] Step S24: Correct the compliance quantification value using the correction factor, and then fuse the corrected compliance quantification value with the performance quantification value using adaptive weights to generate preliminary analysis results.

[0081] It is understood that the compliance quantification value is reduced and corrected using the correction factor to incorporate the risks represented by evidence gaps and external special data into the compliance dimension. Then, the corrected compliance quantification value and the performance quantification value are fused with adaptive weights to generate preliminary analysis results. The adaptive weights are dynamically adjusted according to the corrected compliance quantification value. When the corrected compliance quantification value is lower than the preset compliance threshold, the weight coefficient of the compliance dimension is automatically increased, and an upper limit cutoff value is set to constrain the weight from being overly biased towards the compliance dimension. Thus, while taking into account both task completion and compliance risks, the preliminary analysis results can dynamically reflect the changes in the importance of different dimensions.

[0082] Furthermore, step S24 specifically includes the following steps: The compliance quantification value is adjusted by deducting the correction factor to obtain the corrected compliance quantification value. The performance quantification value and the corrected compliance quantification value are fused using adaptive weighting to generate preliminary analysis results; wherein, when the corrected compliance quantification value is lower than a preset compliance threshold, the weight coefficient of the compliance dimension is automatically increased, and the weight coefficient has an upper limit cutoff value.

[0083] It should be noted that the compliance quantification value is adjusted by deducting the correction factor to incorporate the risks represented by the broken evidence data and external special data into the compliance dimension, resulting in a corrected compliance quantification value. Subsequently, the performance quantification value and the corrected compliance quantification value are fused with adaptive weights to generate preliminary analysis results. When the corrected compliance quantification value is lower than the preset compliance threshold, the weight coefficient of the compliance dimension is automatically increased, and the weight coefficient has an upper limit cutoff value to prevent the contribution of the performance dimension from being excessively suppressed due to the excessive weight of the compliance dimension.

[0084] This embodiment, through the above scheme, calculates the performance quantification value by statistically analyzing the task completion rate and quality score of the trusted record set and employing a short-board constraint aggregation rule. The short-board constraint aggregation rule takes the minimum value between the task completion rate and the normalized value of the quality score. It extracts violation records from the trusted record set and determines the violation type, using a preset full score as the initial value. Based on the mapping relationship between the violation type and the deduction value, a gradient deduction is performed to obtain the compliance quantification value, wherein the deduction value is positively correlated with the risk level of the system resource call chain represented by the violation type. The compliance quantification value is corrected using the correction factor, and the corrected compliance quantification value is fused with the performance quantification value through adaptive weighting to generate preliminary analysis results. This allows for the use of short-board constraint aggregation rules to analyze tasks... The minimum value of completion rate and quality score is taken to prevent a high indicator in one dimension from masking a deficiency in another, thus improving the balance and rigor of the performance evaluation. Simultaneously, by applying a gradient deduction based on the mapping relationship between violation type and deduction value, and by making the deduction value positively correlated with the risk level of the system resource call chain, high-risk violations are more strongly constrained, increasing the sensitivity of the compliance evaluation to system security risks. Correction factors are used to adjust the compliance evaluation, and preliminary analysis results are generated through adaptive weight fusion. This allows risks represented by evidence gaps and external special data to be included in the compliance dimension. Weights are automatically adjusted based on the dynamic changes in the compliance evaluation and an upper limit cutoff value is set to prevent excessive weight bias towards a single dimension, thereby improving the comprehensiveness, dynamic adaptability, and accuracy of the preliminary analysis results.

[0085] Furthermore, Figure 5 This is a flowchart illustrating the fourth embodiment of the AI ​​agent behavior data analysis method of the present invention, as shown below. Figure 5 As shown, based on the first embodiment, a fourth embodiment of the AI ​​intelligent agent behavior data analysis method of the present invention is proposed. In this embodiment, step S30 specifically includes the following steps: Step S31: Perform at least one of the following post-adjustments on the preliminary analysis results through the post-adjustment engine, wherein the post-adjustment engine includes at least one of the following sub-engines: insufficient data processing sub-engine, confidence factor sub-engine, group relative positioning sub-engine, and trend analysis sub-engine.

[0086] It should be noted that after the automated calculation engine generates the preliminary analysis results, the post-adjustment engine performs at least one post-adjustment operation on the preliminary analysis results. The post-adjustment engine contains at least one of the following sub-engines corresponding to the above post-adjustment operations: a data deficiency processing sub-engine, a confidence factor sub-engine, a group relative positioning sub-engine, and a trend analysis sub-engine. Each sub-engine independently performs the corresponding adjustment operation, and the output of each sub-engine is presented independently in different fields in the standardized confidence analysis signal without changing the quantitative value itself in the preliminary analysis results.

[0087] Step S32: When the data volume of the preliminary analysis result is lower than a preset threshold, generate a smoothly transitioned quantized value through the insufficient data processing sub-engine, as the input reference for subsequent sub-engines.

[0088] It should be noted that, when the data volume of the preliminary analysis result is lower than the preset threshold, the smoothly transitioned quantized value is generated by the insufficient data processing sub-engine, and the quantized value is generated by weighted fusion of the initial baseline and the actual calculated value according to a smooth transition coefficient, so as to suppress the volatility of the evaluation result in a data sparse scenario, and the smoothly transitioned quantized value is used as the input reference for each subsequent sub-engine, ensuring that subsequent processing can still be executed based on a stable quantized value when data is insufficient.

[0089] Further, the step S32 specifically includes the following steps: When the data volume of the preliminary analysis result is lower than the preset threshold, the number of current behavior events M is acquired through the insufficient data processing sub-engine, and the preset first transition threshold T1 and second transition threshold T2 are acquired, where T1<T2; When M≤T1, the smoothly transitioned quantized value directly adopts the initial baseline value; When T1<M<T2, the smoothly transitioned quantized value is calculated by the following formula:

[0090] wherein, is the quantized value, is the initial baseline value, is the actual calculated value, is the smooth transition coefficient, which increases monotonically with M; When M≥T2, the smoothly transitioned quantized value directly adopts the actual calculated value.

[0091] It should be noted that, when the data volume of the preliminary analysis result is lower than the preset threshold, the insufficient data processing sub-engine acquires the number of current behavior events M, and acquires the preset first transition threshold T1 and second transition threshold T2, where T1<T2; when M≤T1, it indicates that the data volume is severely insufficient, and the smoothly transitioned quantized value directly adopts the initial baseline value P0 to avoid drastic fluctuation of the result caused by too few samples; when T1<M<T2, it indicates that the data volume is in a transition interval, and the smoothly transitioned quantized value is calculated according to the above formula, so that the quantized value smoothly transitions from the initial baseline to the actual calculated value as the data volume increases, taking into account both stability and authenticity; when M≥T2, it indicates that the data volume is sufficiently sufficient, and the smoothly transitioned quantized value directly adopts the actual calculated value, so as to fully reflect the actual behavior level when the data is sufficient; the whole process solves the problem of poor reliability of the quantized value in the insufficient data scenario through segmented processing, and provides a stable input reference for subsequent sub-engines.

[0092] Step S33: After generating the quantized value, the quantized value is labeled with confidence level using the confidence factor scoring engine without changing the quantized value itself.

[0093] It is understood that after the quantified value is generated, a confidence factor is generated based on the cumulative data volume through the confidence factor scoring engine, and the quantified value is labeled with confidence based on this factor. The confidence label is presented in the standardized credibility analysis signal as an independent field, without changing the quantified value itself. That is, only a reliability identifier is added without modifying the numerical content of the quantified value, so as to reflect the credibility of the current quantified value.

[0094] Furthermore, step S33 specifically includes the following steps: After generating the quantified value, a confidence factor is generated based on the cumulative data volume, wherein the confidence factor is positively correlated with the cumulative data volume, and the cumulative data volume is the total number of behavioral records in the trusted record set; When the cumulative data volume is lower than a preset data volume threshold, the confidence factor is lower than a preset confidence threshold; The confidence factor scoring engine is used to label the quantified value with confidence. The confidence label is presented as an independent field in the standardized credible analysis signal without changing the quantified value itself.

[0095] It should be noted that after generating the quantized value, a confidence factor is generated based on the cumulative data volume, where the cumulative data volume is the total number of behavioral records in the trusted record set. The confidence factor is positively correlated with the cumulative data volume; that is, the larger the cumulative data volume, the higher the confidence factor. When the cumulative data volume is lower than a preset data volume threshold, the confidence factor is less than the preset confidence threshold, indicating that the reliability of the current quantized value is low. Subsequently, the quantized value is labeled with confidence using the confidence factor sub-engine. The confidence label is presented as an independent field in the standardized trusted analysis signal without changing the numerical content of the quantized value itself. This provides downstream systems with reference information regarding the reliability of the quantized value while maintaining the quantized value unchanged.

[0096] Step S34: Generate dynamic group baseline scores based on group data of similar intelligent agents.

[0097] It should be understood that dynamic group baseline scores are generated based on group data of similar intelligent agents, forming a dynamically evolving group reference standard.

[0098] Furthermore, step S34 specifically includes the following steps: The AI ​​agent is identified as belonging to the same category as the AI ​​agent according to a preset classification strategy. When the sample size of the dimension combination in the query conditions is insufficient, the data is automatically reverted to the baseline data of the higher-level dimension. The preset classification strategy includes at least one of the following: classification by task type, classification by application scenario, and classification by function category. Historical behavior data of each similar intelligent agent is collected from the group of intelligent agents, and statistical characteristics of the behavior quantification values ​​corresponding to the historical behavior data are calculated. The statistical characteristics include at least one of mean, median, standard deviation, and quantile. A dynamic population baseline score is generated based on the statistical characteristics. The dynamic population baseline score is continuously accumulated and updated as the system runs, so as to form a dynamically evolving reference system. Determine whether the number of similar agent samples under the currently selected combination of classification dimensions meets the preset quantity requirement; When the number of similar intelligent agent samples does not meet the preset quantity requirement, it automatically reverts to the baseline data of the higher dimension.

[0099] It should be noted that, according to a preset classification strategy, a group of intelligent agents belonging to the same category as the current AI agent is determined based on at least one dimension, including task type, application scenario, and functional category, to establish a reference range at the group level. Within this reference range, historical behavioral data of each intelligent agent of the same category is collected from the intelligent agent group, and statistical characteristics such as the mean, median, standard deviation, and quantiles of the corresponding behavioral quantification values ​​are statistically analyzed. Based on this, a dynamic group baseline score is generated. The dynamic group baseline score is continuously accumulated and updated as the system runs, forming a dynamically evolving reference system. During the generation of the dynamic group baseline score, it is determined whether the number of similar intelligent agent samples under the currently selected combination of classification dimensions meets the preset quantity requirement. If the number of samples is sufficient, the baseline score is generated based on the statistical characteristics of the dimension combination. If the number of samples is insufficient, to avoid the distortion of the baseline score due to the sparse samples of a single dimension, the system automatically reverts to the baseline data of the upper-level dimension, using the more sufficient sample data under the upper-level dimension as the basis for generating the reference system, thereby ensuring that the dynamic group baseline score still has statistical validity and reliability in the case of sparse samples.

[0100] In the specific implementation, the "group baseline score" mentioned in this embodiment refers to the specific manifestation of the behavioral baseline at the group level, that is, a reference system generated based on the statistical characteristics of the quantitative values ​​of the behavior of similar intelligent agents, including but not limited to the mean, median, standard deviation, quantiles and other statistical quantities of the quantitative values ​​of the behavior of similar intelligent agents; the similarity refers to the classification of intelligent agent groups automatically divided by the system according to the technical characteristics of the intelligent agents such as task type, application scenario, and functional category. The group baseline score is continuously accumulated and updated as the system runs, forming a dynamically evolving reference system.

[0101] The population baseline is an optional enhancement in this embodiment, not a prerequisite for system operation. When the population baseline cannot be generated due to insufficient sample size, data sovereignty restrictions, or lack of authorization, the system can still independently complete behavioral credibility analysis through the basic data processing logic of each engine and output standardized credibility analysis signals.

[0102] Furthermore, prior to step S34, the AI ​​agent behavior data analysis method further includes the following steps: When the dynamic group baseline score cannot be generated, an individual behavior baseline is generated based on the historical behavior data of the AI ​​agent, and the individual deviation of the preliminary analysis result relative to the individual behavior baseline is calculated. The standardized reliable analysis signal also includes an individual deviation field relative to the individual behavior baseline.

[0103] It should be understood that, in the absence of a dynamic group baseline score, the system generates an individual behavior baseline based on the AI ​​agent's own historical behavior data, serving as a substitute benchmark when a group-level reference is missing. Subsequently, the preliminary analysis result is compared with this individual behavior baseline, and the individual deviation of the preliminary analysis result relative to the individual behavior baseline is calculated to characterize the degree of deviation of the AI ​​agent's current behavior level from its own historical patterns. The individual deviation is filled into a preset individual deviation field in the standardized credible analysis signal, which, together with the credible quantification value, constitutes the content of the standardized credible analysis signal. This allows the system to output credible analysis results containing relative position references even under the limited condition of insufficient group data, ensuring the integrity and continuity of the output signal and expanding the applicability of the standardized credible analysis signal.

[0104] It should be noted that the behavioral baseline refers to the numerical representation of the behavioral patterns, boundaries, and characteristics exhibited by an AI agent during operation. The behavioral baseline can be the individual behavioral baseline of a single AI agent or the group behavioral baseline of a group of similar AI agents.

[0105] Individual behavior baselines describe the behavioral patterns of a specific AI agent under normal operating conditions, including but not limited to task execution patterns, resource consumption patterns, operation call sequences, and decision output distribution.

[0106] The group behavior baseline (i.e., the group baseline score) is a reference system generated based on the statistical characteristics of the quantitative values ​​of the group behavior of similar intelligent agents. It is the specific manifestation of the behavior baseline at the group level.

[0107] Step S35: After the dynamic population baseline score is generated, the deviation of the preliminary analysis result from the dynamic population baseline score is calculated by the population relative positioning score engine, and a standardized reliable analysis signal is output without changing the quantization value itself. The standardized reliable analysis signal includes at least a reliable quantization value.

[0108] It is understood that after the dynamic group baseline score is generated, the preliminary analysis result can be compared with the dynamic group baseline score through the group relative positioning score engine to calculate the deviation of the preliminary analysis result relative to the dynamic group baseline score, so as to characterize the relative position of the AI ​​agent in the same group of agents; then, a standardized credible analysis signal containing at least a credible quantization value is output, wherein the deviation is presented as an independent field in the standardized credible analysis signal, and the credible quantization value itself is not changed.

[0109] Furthermore, step S35 specifically includes the following steps: After the dynamic group baseline score is generated, the preliminary analysis result is compared with the dynamic group baseline score through the group relative positioning score engine. The deviation of the preliminary analysis result relative to the dynamic group baseline score is calculated based on the comparison result. The deviation is used to characterize the relative position of the AI ​​agent's behavior level in a group of similar agents. The deviation is output as an independent field to a standardized confidence analysis signal, wherein the quantization value in the standardized confidence analysis signal remains unchanged.

[0110] It should be noted that after the dynamic group baseline score is generated, the preliminary analysis result is compared with the dynamic group baseline score through the group relative positioning score engine. Based on the comparison result, the deviation of the preliminary analysis result from the dynamic group baseline score is calculated to characterize the relative position of the AI ​​agent's behavior level in a group of similar agents. Subsequently, the deviation is output as an independent field to the standardized trustworthy analysis signal, which together with the trustworthy quantization value constitutes the content of the standardized trustworthy analysis signal, while the quantization value in the standardized trustworthy analysis signal itself remains unchanged.

[0111] Furthermore, after outputting the deviation as an independent field to the standardized reliable analysis signal, the AI ​​agent behavior data analysis method further includes the following steps: Through a standardized external data interface, the trusted analysis node corresponding to the standardized trusted analysis signal is synchronized with other nodes according to a preset synchronization strategy, and data from other nodes is received to correct the local reference system. The nodes are interconnected through the standardized data flow interface to form a distributed data processing network, which is used to exchange group baseline data to generate a cross-domain global reference system.

[0112] It should be noted that, through a standardized external data interface, the standardized trusted analysis signals generated by the local node are sent to other nodes according to a preset synchronization strategy, enabling all nodes to share the same standardized analysis results. Simultaneously, data transmitted from other nodes is received to correct the reference system data maintained by the local node, thereby improving the accuracy and consistency of the local reference system. Based on this, multiple nodes are interconnected through a standardized data flow interface to construct a distributed data processing network. Each node specifically exchanges its maintained group baseline score data, thereby aggregating the group statistical information from multiple nodes to jointly generate a cross-domain global reference system with broader coverage and greater global representativeness. This allows each node to share group dimension data through this distributed network while operating independently, improving the horizontal comparability and consistency of behavioral analysis within the entire network system.

[0113] It is understood that the trusted analysis node mentioned in this embodiment refers to a system instance composed of the multiple engines, which has complete and independent data processing capabilities and can be deployed in a single computing environment. After the multiple trusted analysis nodes are interconnected through standardized data flow interfaces, they can form a distributed data processing network.

[0114] Step S36: When trend analysis is required, the trend slope is calculated through the trend analysis engine without changing the quantified value itself.

[0115] It should be understood that when trend analysis is required, the trend slope is calculated by obtaining the preliminary analysis results through the trend analysis engine without changing the quantification value itself. This provides reference information to the standardized reliable analysis signal, representing the trend of the AI ​​agent's behavior level over time, while keeping the quantification value unchanged.

[0116] Furthermore, step S36 specifically includes the following steps: When trend analysis is required, time series analysis result data is obtained through the trend analysis sub-engine. The time series analysis result data is a quantified value sequence of the preliminary analysis result at multiple time points. A trend trajectory is generated based on the time series analysis results, and the trend slope is calculated using sliding window linear regression. The trend direction and trend level are output according to a preset slope threshold range, wherein the trend direction includes at least one of rising, falling or stable. The trend direction and the trend level are output as independent fields to the standardized confidence analysis signal, and the quantized value in the standardized confidence analysis signal remains unchanged.

[0117] It should be noted that when trend analysis is required, the trend analysis engine obtains the quantized value sequence of the preliminary analysis results at multiple time points, generates a trend trajectory based on the quantized value sequence, and calculates the trend slope using sliding window linear regression. Subsequently, the trend direction and trend level are output according to a preset slope threshold range, wherein the trend direction includes at least one of rising, falling, or stable. The trend direction and trend level are output as independent fields to the standardized reliable analysis signal without changing the quantized value itself in the standardized reliable analysis signal. Thus, while keeping the quantized value unchanged, reference information characterizing the trend of the AI ​​agent's behavior level changing over time is provided to the downstream system.

[0118] Step S37: The output of each sub-engine is presented independently in different fields in the standardized trustworthy analysis signal.

[0119] It is understood that the output of each sub-engine is presented independently in different fields in the standardized reliable analysis signal. This means that the processing results such as smooth transition quantification values, confidence labels, deviations, and trend slopes generated by the data deficiency processing sub-engine, confidence factor sub-engine, group relative positioning sub-engine, and trend analysis sub-engine correspond to preset independent fields in the standardized reliable analysis signal. Each field does not interfere with the others and independently carries the output content of the corresponding sub-engine, so as to maintain the structural clarity and parsing stability of the standardized reliable analysis signal and ensure that the downstream system can directly parse the required data according to the field definition.

[0120] It should be noted that the "engine" mentioned in this embodiment refers to a computer module with independent data processing capabilities. This module can be an independent computer process, microservice, container instance, or a logical unit executed by a computer. Each engine has a clear input data format, output data format, and internal processing logic. Multiple engines are connected and collaborate through standardized data flows.

[0121] In its implementation, this embodiment achieves automated multi-stage processing and transformation of multi-source behavioral data of the AI ​​agent through the collaborative work of the following four engines, ultimately outputting standardized and reliable analysis signals: Trusted Data Acquisition Engine: Acquires behavioral records from multiple data sources, performs multi-source data fusion and format normalization, and automatically divides data into trusted record sets, special record sets, and record sets to be verified, driven by evidence storage status identifiers.

[0122] Special data processing engine: Receives abnormal records and external special data, and converts them into standardized correction factors.

[0123] Automated computing engine: Receives trusted records and correction factors, automatically performs core data calculations and adaptive fusion, and outputs preliminary analysis results.

[0124] Post-adjustment engine: Performs multi-dimensional systematic adjustments on the preliminary analysis results, including data insufficiency handling, confidence level correction, relative positioning of the population and generation of the population baseline score, trend analysis, and outputs the final standardized and reliable analysis signal.

[0125] The four engines are driven by standardized data flow to form a complete automated pipeline of "data acquisition → special processing → core calculation → post-adjustment → signal output". The engines are decoupled from each other through standardized data flow, supporting parallel processing and asynchronous verification.

[0126] Each of the aforementioned sub-engines performs adjustments to the preliminary analysis results in different dimensions. Specifically: the insufficient data processing sub-engine generates a smoothed transition quantified value, which serves as the input benchmark for subsequent sub-engines; the confidence factor sub-engine labels the quantified value with confidence level without changing the quantified value itself; the group relative positioning sub-engine calculates the deviation without changing the quantified value itself; and the trend analysis sub-engine calculates the trend slope without changing the quantified value itself. The outputs of each sub-engine are presented independently in different fields in the standardized confidence analysis signal.

[0127] Step S38: When the dynamic population baseline score is generated, the standardized reliable analysis signal also includes the deviation.

[0128] It should be understood that when the dynamic population baseline score is generated, the standardized credibility analysis signal, in addition to including the credibility quantification value, will also fill the deviation field with the deviation degree, which is one of the preset fields in the standardized credibility analysis signal.

[0129] Furthermore, step S38 specifically includes the following steps: When the dynamic population baseline score is generated, the standardized credibility analysis signal, in addition to including the credibility quantification value, also fills the deviation field with the deviation degree; wherein, the deviation degree field is one of the preset fields in the standardized credibility analysis signal, and the standardized credibility analysis signal adopts a fixed field format and includes all preset fields; When the dynamic population baseline score is not generated, the deviation field is filled with a null value or a preset value, and the other fields in the standardized confidence analysis signal are unaffected.

[0130] Understandably, when the system successfully generates a dynamic population baseline score, the standardized reliable analysis signal will retain the original reliable quantification value and write the calculated deviation into a field position specifically preset for that data in the signal. This deviation field is not a temporary addition, but a permanent component in the fixed format of the standardized signal. If the dynamic population baseline score fails to be generated due to insufficient sample size, lack of authorization, or other reasons, the deviation field in the signal will not be deleted or omitted, but will be filled with a null value or a preset value, thereby ensuring that the overall structure of the signal remains intact and consistent, and the format will not change due to the absence of some data. The contents of the other fields will also remain unchanged and unaffected.

[0131] Furthermore, the trusted quantification value is a numerical representation of the AI ​​agent's behavioral level, calculated based on the trusted record set.

[0132] It should be understood that the credible quantization value is a numerical result obtained by quantifying the credible record set. This value is used to characterize the overall level of the AI ​​agent at the behavioral level, reflecting the agent's behavioral performance in a comparable and processable numerical form, thereby providing a unified quantitative basis for subsequent fusion analysis, group comparison and standardized signal output.

[0133] In its implementation, the core engine includes: Engine 1: Trusted Data Acquisition Engine.

[0134] Project (input), content: raw behavior log (including evidence status identifier), multi-source interaction records, and external feedback data.

[0135] Project (processing), content: multi-source data fusion (timestamp alignment, deduplication, conflict arbitration), format normalization, and evidence storage status classification.

[0136] Project (output), contents: Trusted record set (→ Engine 3), Special record set (→ Engine 2), Record set to be verified (→ Engine 2 asynchronous queue).

[0137] The trusted data acquisition engine is configured to acquire the behavior records of AI agents from multiple data sources, perform multi-source data fusion, format normalization and trustworthiness verification, and classify the behavior records into trusted record sets, special record sets and record sets to be verified according to the evidence status identifier.

[0138] The multiple data sources include at least one of the following: interaction record interfaces provided by a centralized platform, behavior evidence records carried by the AI ​​agent itself, service performance feedback data collected in a trusted manner, and judgment records returned by external systems.

[0139] The behavior record includes the following fields: agent identifier, task identifier, timestamp, task type, execution result, resource consumption, violation type, and evidence storage status identifier.

[0140] The agent identifier adopts a globally unique identity identifier format.

[0141] Upon receiving new data, Engine 1 performs the following processing: (1) Multi-source data fusion: timestamp alignment, duplicate record deduplication, and violation type conflict arbitration are performed on records from different data sources; wherein, the violation type conflict arbitration adopts the strict principle.

[0142] When there are three or more conflicting flags, they are prioritized according to severity, and the flag with the highest risk level is selected as the final decision.

[0143] (2) Format normalization: Data of different input formats are uniformly converted to generate a standard behavior record format within the system; the format normalization includes at least field mapping, data type conversion and timestamp standardization.

[0144] (3) Reliability Classification: Based on the evidence storage status identifier, the records are divided into three categories: Complete evidence storage → Trusted record set, sent to the automated computing engine.

[0145] Broken evidence → Special record set, sent to a special data processing engine.

[0146] Evidence awaiting verification → The set of records awaiting verification is sent to the verification queue of a special data processing engine for asynchronous processing, without blocking the main process.

[0147] For the objective verification portion of the feedback data from external sources, Engine 1 processes it based on the consistency flags it carries: A record marked as "consistent" is included in the trusted record set.

[0148] Consistency is marked as "inconsistent" → classified into a special record set.

[0149] The consistency is marked as "to be verified" → included in the set of records to be verified.

[0150] Engine 2: Special Data Processing Engine Item (input), content: special record set (broken evidence), record set to be verified (evidence to be verified), external special data (standardized interface).

[0151] Project (processing), content: negative signal identification and quantification conversion, asynchronous verification to be verified; Project (output), content: correction factor (→ Engine 3).

[0152] The special data processing engine is configured to receive special record sets and record sets to be verified sent by the trusted data acquisition engine, as well as external special data received through the standardized external data interface reserved by the system.

[0153] The external special data includes the following types: Records of data integrity breaches are identified as “data integrity compromised” and correction factors are generated according to preset mapping rules.

[0154] Records of actions pending verification: temporarily stored in the verification queue, without blocking the main process.

[0155] The system performs verification asynchronously, and the verification window period is configurable (default 24 hours): Once the verification confirms the data is complete, it will be moved back to Engine 1 and included in subsequent processing.

[0156] Verification confirms fracture → Generate correction factor.

[0157] If the verification fails to complete within the time limit, it will be handled according to the preset strategy (the trust weight will be reduced and the data will be included with a lower weight).

[0158] The judgment records returned by the external system generate corresponding correction factors according to the judgment type and severity level, based on preset mapping rules.

[0159] The processing results returned by the external system are recorded as follows: Based on the processing conclusions, corresponding correction factors are generated according to preset mapping rules.

[0160] The common characteristic of the external special data is that they all originate from the judgment results of the system's internal evidence verification module, or from data confirmed by an independent external system, and do not rely on unverified third-party subjective evaluations.

[0161] Engine 2 outputs a correction factor to the automated calculation engine.

[0162] Engine 3: Automated Calculation Engine Item (input), content: trusted record set (from engine one), correction factor (from engine two).

[0163] Project (processing), content: performance quantitative calculation, compliance quantitative calculation, adaptive weight fusion.

[0164] Project (output), content: preliminary analysis results (→ Engine 4).

[0165] The automated calculation engine is configured to receive a trusted record set sent by the trusted data acquisition engine and a correction factor sent by the special data processing engine; calculate the performance quantification value and compliance quantification value based on the trusted record set; correct the compliance quantification value according to the correction factor; and merge the corrected performance quantification value and compliance quantification value to generate preliminary analysis results.

[0166] Specifically: (1) Calculation of performance quantification value: The task completion rate and quality score are aggregated according to the preset aggregation rules to generate the performance quantification value.

[0167] The preset aggregation rule is a bottleneck constraint aggregation: P = 100 × min(task completion rate, quality score / 100), where task completion rate ≤ 1 and quality score / 100 ≤ 1.

[0168] The technical rationale for the bottleneck constraint aggregation is that in the task execution chain, the task completion rate and quality score are independent of each other. A weakness in any link is enough to lead to insufficient overall performance capability. There is no technical logic to compensate for the weakness of another link by a high score in one link.

[0169] (2) Compliance quantification value calculation: The initial value is the preset full score (preset 100 points). The score is deducted in a gradient according to the mapping relationship between the violation type and the deduction value. The lower limit of the compliance quantification value is 0 points.

[0170] In the mapping relationship, the deduction value is positively correlated with the risk level of the system resource call chain represented by the violation type.

[0171] Specifically: Unauthorized operations involve substantive access to unauthorized resources, which is of high risk and corresponds to the upper limit of the deduction gradient; rule violations involve procedural breaches, which are of medium risk and correspond to the median of the deduction gradient; abnormal evidence storage involves damage to data integrity, which is of high risk and corresponds to the upper limit of the deduction gradient.

[0172] The specific deduction mapping for each type of violation is automatically generated by the system during initialization based on the statistical distribution of historical violation data, or configured by the system administrator in the compliance management module, rather than relying on static subjective assignment by humans.

[0173] In one embodiment, unauthorized operation deducts 15 points, rule violation deducts 10 points, and each abnormal evidence storage is deducted 10 points.

[0174] (3) Modification factor superposition: C_modified = C_initial - Σ(modification factor).

[0175] The various correction factors output by Engine 2 are superimposed onto the compliance quantification value.

[0176] (4) Adaptive weight fusion: The performance quantification value and the modified compliance quantification value are fused to generate preliminary analysis results: S_preliminary=α×P+β×C_modified.

[0177] Where α is the weight coefficient for the performance dimension and β is the weight coefficient for the compliance dimension, and α+β=1.

[0178] When the corrected compliance quantification value is lower than the preset threshold T, the system automatically increases the weight coefficient β of the compliance dimension.

[0179] The preset threshold T can be configured by the system according to the application scenario (preset 60 points). The increase of β is positively correlated with the degree of deviation of the compliance quantification value from the threshold, and β has an upper limit cutoff value (preset 0.9).

[0180] The advantage of the adaptive weight fusion technique is that the weight coefficients are automatically calculated by the system based on the data status, rather than relying on fixed weights set manually.

[0181] When the compliance quantification value is below the threshold, it indicates that there is a high proportion of abnormal records in the subject's behavioral data. Such data should be given higher weight during fusion to ensure that the final output signal can truly reflect the data quality.

[0182] This is an automatic adaptation of the data signal-to-noise ratio, which is a technical constraint at the data processing level, rather than a business choice.

[0183] Engine 4: Rear-mounted tuned engine: Project (input), Content: Preliminary analysis results (from Engine 3); Project (processing), content: data insufficiency handling, confidence level correction, population relative positioning and population baseline score generation, trend analysis; Project (output), content: standardized reliable analysis signals (including reliable quantitative values, reliability level, trend labels, warning level, population baseline score, and deviation).

[0184] The post-adjustment engine is configured to receive the preliminary analysis results sent by the automated calculation engine; perform multi-dimensional systematic adjustments on the preliminary analysis results; and output the final standardized and reliable analysis signal.

[0185] The standardized trusted analysis signal output by the post-adjustment engine adopts a fixed field format, which includes all preset fields. When a certain sub-engine is not enabled, the field corresponding to that sub-engine is filled with null values ​​or preset default values. The preset fields include trusted quantification value, trusted level, population baseline score, deviation, trend label, warning level, and confidence label. The above fixed field format ensures that the downstream system does not need to distinguish the signal source of different agents when parsing the standardized trusted analysis signal, and can directly complete the parsing and calling according to the unified field definition.

[0186] The rear tuning engine includes the following sub-engines that can be enabled independently or in combination: (1) Data Insufficiency Handling Engine: When the data volume of the trusted record set is lower than a preset threshold (the preset number of behavior events is less than 10), cold start processing is triggered: statistical features of similar AI agents are retrieved to generate an initial baseline, and a smooth transition is adopted to gradually switch to dynamic evaluation.

[0187] The smooth transition is: acquiring the current number of behavior events M, and acquiring a preset first threshold T1 and a preset second threshold T2 (T1<T2); when M≤T1, the smooth transition coefficient γ=0; when T1<M<T2, γ increases monotonically with M; when M≥T2, γ=1; the final quantized value=(1-γ)×initial baseline+γ×actual calculated value.

[0188] In one embodiment, T1=10, T2=30, γ=min(1,(M-10) / 20).

[0189] This formula indicates that when M<10, γ=0 (completely relying on the initial baseline), when M ranges from 10 to 30, γ increases linearly from 0 to 1, and when M≥30, γ=1 (completely switching to dynamic evaluation).

[0190] (2) Confidence factor sub-engine: Confidence correction is performed on the analysis result based on the accumulated data volume.

[0191] The larger the accumulated data volume, the higher the confidence of the analysis result, and a confidence label is output.

[0192] In one embodiment, a data volume of ≥100 entries is labeled as "high confidence", 30-99 entries as "medium confidence", and <30 entries as "low confidence".

[0193] (3) Group relative positioning sub-engine: The behavior quantized value of the agent is compared with the group distribution of agents of the same category, and the deviation degree and relative position are output.

[0194] Specifically, this sub-engine continuously accumulates the behavior quantized values of similar agents, generates and maintains a group baseline score based on the accumulated data: including statistics such as the mean, median, standard deviation, and quantile of the quantized values of similar agents.

[0195] When processing a single agent, this sub-engine compares the quantized value of the current agent with the group baseline score, calculates the deviation degree, and outputs the relative position of the agent in the similar group.

[0196] The calculation method of the deviation degree is: d=(current quantized value - group mean) / standard deviation, which represents the relative offset of the current quantized value in the group distribution in units of standard deviation.

[0197] Multi-dimensional application of the group baseline score: the group baseline score can be generated and maintained respectively according to the following dimensions: Baseline for task type dimension.

[0198] Application scenario dimension baseline.

[0199] Functional category dimension baseline.

[0200] Combined dimensional baseline (a combination of two or more dimensions).

[0201] When a user or downstream system initiates a query, the corresponding group baseline score is automatically matched based on the combination of dimensions in the query conditions.

[0202] If the sample size for a certain dimension combination is insufficient (less than a preset threshold), the system will automatically revert to the baseline data of the next higher dimension.

[0203] The baseline score of the population is continuously accumulated and updated as the system runs: after each analysis is completed, the system incorporates the new quantitative value into the population dataset of the corresponding dimension and recalculates the statistics.

[0204] In one embodiment, the population relative positioning engine also supports the fusion of population baseline data from other trusted analysis nodes through an inter-node data exchange interface to generate a cross-domain global reference system.

[0205] (4) Trend Analysis Engine: A trend trajectory is generated based on the time series analysis results. The trend slope is calculated using sliding window linear regression, and the trend direction and deterioration level are output.

[0206] Specifically, a sliding window linear regression is used (window size is configurable, preset to 7 days), and the average slope of the most recent N windows is taken to determine the trend direction (N is configurable, preset to 3).

[0207] The downward trend is further divided into three levels: mild, moderate and severe. The slope threshold range corresponding to each level can be configured by the system according to the application scenario.

[0208] In one embodiment, mild deterioration corresponds to -0.1 ≤ S_avg < -0.05, moderate deterioration corresponds to -0.2 ≤ S_avg < -0.1, and severe deterioration corresponds to S_avg < -0.2.

[0209] Each sub-engine can be enabled independently or in combination. The combination method is determined by the system automatically loading the corresponding sub-engine configuration based on the task type during initialization.

[0210] The standardized credibility analysis signals output by the post-adjustment engine include: credibility quantification value, credibility level, trend label, warning level, population baseline score, and deviation.

[0211] The correspondence between the trust level and the trust quantification value is as follows: 90-100 points is level A, 70-89 points is level B, 50-69 points is level C, and 0-49 points is level D.

[0212] The correspondence between warning levels and deterioration levels can be configured by the system according to the application scenario.

[0213] In a specific implementation, Example 1: Analysis of the routine behavior of the customer service AI agent: A customer service AI agent completed 98 tasks and succeeded 96 times in the first 20 days of its 30-day operation period, with no violations recorded. In the last 10 days, it completed 30 tasks and succeeded 25 times, but made two unauthorized calls. All behavior records were recorded as "complete evidence".

[0214] The system has accumulated 350 data points of similar customer service agents, and a group baseline score has been established (mean 75 points, standard deviation 8 points).

[0215] Engine 1 Processing: The system collects behavioral event records from the agent's task execution logs daily, and all 128 records are categorized into a trusted record set and sent directly to Engine 3.

[0216] Engine 2 processing: No special data received, correction factor is zero.

[0217] Engine 3 processing: Performance quantification: Task completion rate 94.5%, quality score 85 points, P=85 points.

[0218] Compliance quantification value calculation: 15 points will be deducted for each of the two unauthorized operations, C=70 points.

[0219] Adaptive weighted fusion: Credit score = 0.6 × 85 + 0.4 × 70 = 79 points.

[0220] Engine 4 Processing: Group Relative Positioning Sub-engine: Read the population baseline score (mean 75, standard deviation 8).

[0221] Calculate the deviation: (79-75) / 8 = 0.5 standard deviations.

[0222] Output relative position: above the group mean, in the top 35%.

[0223] Engine 4 Processing: Other Sub-engines: Confidence factor engine: The cumulative data volume is large, and it is marked as "high confidence".

[0224] Trend analysis engine: S_avg=-0.08, judged as "downward trend (slight deterioration)".

[0225] Output: Confidence quantification score 79, confidence level B, population mean 75, deviation +0.5σ, relative position "top 35%", trend label "downward trend (slight deterioration)", marked "high confidence".

[0226] Example 2: Risk Warning of AI Agent in Financial Transactions A certain financial transaction AI agent consistently maintained a performance quantitative value above 90 points, but its compliance quantitative value gradually decreased from 95 points to 38 points within 30 days.

[0227] The system also received one judgment record from an external system through a standardized external data interface (judgment type = "behavior deviation confirmation", severity = "severe").

[0228] The system has accumulated 120 data entries of similar financial transaction intelligence agents, and a group baseline score has been established (mean 68 points, standard deviation 10 points).

[0229] Engine 1 processes: All records are fully documented and included in the trusted record set.

[0230] Engine 2 processing: Receive external judgment records, and output correction factors according to preset mapping rules (serious deviation corresponds to a deduction of 20 points).

[0231] Engine 3 processing: The performance evaluation score is P = 92 points.

[0232] The compliance quantification value C_initial = 38 points, and after adding the correction factor, C_modified = 18 points.

[0233] Adaptive weight fusion: If C_modified is below the threshold of 60 points, the compliance weight is automatically increased to 0.6, and the credit score = 0.4×92+0.6×18=47.6 points.

[0234] Engine 4 Processing: Group Relative Positioning Sub-engine: Read the population baseline score (mean 68 points, standard deviation 10 points).

[0235] The deviation is calculated as (47.6-68) / 10 = -2.04 standard deviations.

[0236] Output relative position: below the group mean, in the bottom 5%.

[0237] Engine 4 Processing: Other Sub-engines: Trend analysis engine: S_avg=-0.25, judged as "downward trend (severe deterioration)".

[0238] The trust level has been forcibly downgraded to level D.

[0239] Output: Credibility score 47.6, credibility level D, group mean 68, deviation -2.04σ, relative position "bottom 5%", trend label "downward trend (severe deterioration)", warning level "immediate action recommended".

[0240] Example 3: Cold Start and Smooth Transition of New AI Agents: A new AI agent is launched for the first time, with no historical behavioral data (number of behavioral events M=0).

[0241] The baseline scores for similar intelligent agent groups have not yet been established (insufficient sample size).

[0242] Engine 1 processing: If the trusted record set is empty, send a "data insufficient" flag to Engine 4.

[0243] Engine 4 Processing: Insufficient Data Handling Triggered by Engine: Statistical characteristics of similar mature intelligent agents were retrieved: μ=75, σ=8.

[0244] The initial baseline S0 = 75 - 0.5 × 8 = 71 points.

[0245] On the 10th day, M=12: γ=0.1, S=0.9×71+0.1×80=71.9 minutes.

[0246] On day 30, M=35: γ=1, fully switch to dynamic evaluation mode.

[0247] Engine 4 Processing: Group Relative Positioning Sub-engine: The sample size is insufficient to generate the population baseline score, so it is marked as "data accumulation in progress".

[0248] The current quantification value of the intelligent agent is stored in the system as the initial baseline data point.

[0249] Output: Initial baseline score of 71, marked "Cold start phase, baseline based on similar statistics"; group baseline score marked "Data accumulation in progress".

[0250] Example 4: Multi-source data fusion and evidence preservation anomaly handling: A certain AI agent is deployed simultaneously on a centralized platform and in an autonomous operating environment.

[0251] The system obtains behavior records from data source A (platform logs) and data source B (self-stored evidence).

[0252] Engine 1 Processing: Multi-source Data Fusion: Timestamp alignment: Records with deviations exceeding a preset time threshold (such as 5 minutes, but other values ​​are also possible; this embodiment does not impose any restrictions on this) are marked for verification.

[0253] Duplicate record deduplication: based on platform records.

[0254] Violation type conflict: The strict principle is adopted. When all three conflict markers exist at the same time, the highest level is selected according to the severity priority (exceeding authority > rule violation > data anomaly > no violation).

[0255] Five records in data source B have broken evidence chains and have been reclassified into a special record set.

[0256] Engine 2 processing: Receives 5 records of broken evidence, generates a correction factor (5 × 10 points = 50 points deduction) according to the preset mapping rules, and outputs it to Engine 3.

[0257] Engine 3 processing: The compliance quantification value C_initial = 85 points, and after adding the correction factor, C_modified = 35 points.

[0258] Adaptive weighted fusion: Credit score = 0.4 × 90 + 0.6 × 35 = 57 points.

[0259] Engine 4 Processing: Group Relative Positioning Sub-engine: Read the population baseline score (mean 68 points, standard deviation 10 points).

[0260] Calculate the deviation: (57-68) / 10 = -1.1 standard deviations.

[0261] Output: 57 points, group mean 68 points, deviation -1.1σ, marked "evidence abnormal, 5 unreliable records exist".

[0262] Example 5: Asynchronous processing of data to be verified for evidence storage: In the behavior records of a certain AI agent, the status of 3 records is marked as "existing evidence pending verification".

[0263] Engine 1 process: 3 records to be verified are entered into the verification queue without blocking the main process.

[0264] Engine 1 continues to output trusted record sets normally.

[0265] Engine 2 processing: Asynchronous verification: Three records to be verified are temporarily stored in the verification queue.

[0266] The mainstream waterline continues to operate, and these three records are not included in the current analysis.

[0267] Verification must be completed within the verification window (24 hours). Confirmed as complete → Moved back to Engine 1 and included in the next analysis.

[0268] If a fracture is confirmed, a correction factor will be generated and included in the compliance score for the next period.

[0269] If the process fails to complete within the time limit, it will be handled according to the preset strategy.

[0270] Technical effect: The data to be verified does not block the main waterline, and the system maintains continuous operation.

[0271] Example 6: Querying and applying multi-dimensional population baseline scores: A certain intelligent agent scheduling platform needs to set a benchmark threshold for task distribution for "financial transaction collaborative AI intelligent agents".

[0272] The platform administrator initiates a group baseline query request through the system, specifying the dimension combination: task type = financial transaction, function category = collaborative.

[0273] Baseline query service processing: The system identifies dimensions as a two-dimensional combination of "task type + function category".

[0274] Retrieve the target agent population (85 samples) from the baseline sub-database.

[0275] Return the baseline scores for this group: mean 82, median 84, standard deviation 7, top 10% threshold 91, top 25% threshold 87.

[0276] Return a list of quantized values ​​(including agent identifier and trust level) for all 85 agents in the group.

[0277] The labeled sample size is sufficient, and the confidence level is "high".

[0278] Based on the query results, the platform sets the admission threshold at 75 points for subsequent task distribution decisions.

[0279] Example 7: Combined configuration of rear-mounted adjustment engine: Scenario A: Financial Risk Control Scenario Enable the combination: "Confidence Factor + Group Relative Positioning + Trend Analysis".

[0280] The preliminary analysis result of a certain agent is 82 points, the group mean is 75 points, and the deviation is +0.7σ.

[0281] Output: 82 points, marked "high confidence, top 30%, upward trend".

[0282] Scenario B: Evaluation of New Intelligent Agents Enable the combination: "Insufficient data handling + confidence factor".

[0283] Due to insufficient data, the initial baseline score generated during the cold start was 71 points, marked as "low confidence".

[0284] Example 8: Boundary Case Handling Scenario 1: Total number of tasks is 0 If the trusted record set is empty and there is insufficient data, the processing engine will trigger a cold start, output the initial baseline and mark it as "No task record, baseline is based on similar statistics".

[0285] Scenario 2: Compliance score approaches 0 The compliance quantification value C_modified is reduced to 5 points. The automated calculation engine performs adaptive weight calculation: the upper limit of β is truncated to 0.9, and α=0.1. The quantification value = 0.1×85+0.9×5=13 points, and the output is 13 points, without producing a negative value.

[0286] Scenario 3: Missing Evidence Status Indicator If a certain behavior record is missing a record status identifier field, the engine will identify it as "format abnormal". The record will be marked independently and will not be included in any record set. The system will log the abnormality and trigger an alarm.

[0287] Example 9: Data Synchronization Across Trusted Analytics Nodes An AI agent is deployed in both cloud environment A and cloud environment B, and its behavioral data is analyzed by trusted analysis nodes X and Y, which are deployed in the two cloud environments respectively.

[0288] Node X has accumulated the agent's data in cloud environment A and generated a local analysis signal; Node Y has accumulated the agent's data in cloud environment B and generated a local analysis signal.

[0289] Cross-node data synchronization processing: Node X and Node Y establish a connection through a standardized external data interface.

[0290] Both parties exchange group baseline data according to a preset periodic synchronization strategy (synchronizing once every 24 hours).

[0291] After receiving the population baseline score data from node Y, node X merges it with the local population baseline score to generate a cross-domain global population baseline score.

[0292] Node X recalculates the agent's deviation based on the global population baseline score.

[0293] Technical effect: The behavior evaluation of this intelligent agent is no longer limited to a single cloud environment, but obtains objective positioning in a cross-domain global reference system.

[0294] In its specific implementation, this embodiment provides a method for automated analysis of AI agent behavior data through multi-engine collaboration, including the following steps: Step 1: Behavioral data acquisition, multi-source fusion, and format normalization.

[0295] The trusted data acquisition engine obtains behavioral records of the AI ​​agent from multiple data sources, performing multi-source data fusion and format normalization. This step further includes the following sub-steps: Behavioral events are read from at least one data source, including behavioral logs, evidence records, external feedback data, and external judgment records.

[0296] Timestamp alignment, duplicate record deduplication, and violation type conflict arbitration are performed on records from different data sources (adopting the strictest principle).

[0297] Data with different input formats is normalized and uniformly converted into the system's internal standard behavior record format.

[0298] This step outputs the fused standard behavior record set, proceeding to Step 2.

[0299] Step 2: Reading the evidence status identifier and classifying it as trustworthy.

[0300] The trusted data acquisition engine reads the evidence storage status identifier of each multi-source behavior record and classifies it according to the identifier value: If the evidence storage status is marked as "evidence storage complete", the record will be included in the trusted record set.

[0301] If the evidence storage status is marked as "evidence storage broken", the record will be classified into a special record set.

[0302] If the evidence storage status is marked as "evidence storage pending verification", the record will be included in the set of records pending verification.

[0303] For the objective verification portion of the data from external feedback, it is classified according to its consistency flag: A record marked as "consistent" is included in the trusted record set.

[0304] Consistency is marked as "inconsistent" → classified into a special record set.

[0305] The consistency is marked as "to be verified" → included in the set of records to be verified.

[0306] Step 3A: Trusted Record Set Main Path.

[0307] The trusted record set is sent to the automated computing engine, proceeding to Step 4.

[0308] Step 3B: Special record set branch path.

[0309] The special recordset is sent to the special data processing engine, proceeding to Step 8.

[0310] Step 3C: Asynchronous path of the record set to be verified The set of records to be verified enters the verification queue of the special data processing engine, and the asynchronous verification process is started. The main process does not wait and continues to run.

[0311] Step 4: Calculate the performance quantification value.

[0312] After receiving the trusted record set, the automated computing engine performs the following sub-steps: Count the number of successfully completed tasks and the total number of tasks, and calculate the task completion rate.

[0313] Obtain the quality score from the downstream system (if there is no feedback, take the average of the same type).

[0314] The task completion rate and quality score are aggregated according to preset rules to generate a quantitative value for contract fulfillment.

[0315] In one embodiment, the preset aggregation rule is a bottleneck constraint aggregation: P = 100 × min (task completion rate, quality score / 100).

[0316] Step 5: Calculation and correction of compliance quantification values.

[0317] The automated computing engine performs the following sub-steps: The system counts the number and types of violations, deducts points in a tiered manner based on the mapping relationship between violation type and deduction value, and generates a compliance quantification value (the initial value is a preset full score).

[0318] Receive correction factors (if any) from the special data processing engine and add them to the compliance quantification value.

[0319] Generate the revised compliance quantification value: C_modified = C_initial - Σ(modification factor).

[0320] Step 6: Adaptive weight fusion generates preliminary analysis results.

[0321] The automated computing engine performs the following sub-steps: The performance quantification value and the revised compliance quantification value are fused using an adaptive weight: Step_preliminary=α×P+β×C_modified.

[0322] When the corrected compliance quantification value is lower than the preset threshold T, the compliance dimension weight coefficient β is automatically increased; the increase of β is positively correlated with the degree of deviation of the compliance quantification value from the threshold, and β has an upper limit cutoff value.

[0323] Generate preliminary analysis results.

[0324] Step 7: Send the preliminary analysis results.

[0325] Send the preliminary analysis results to the post-adjustment engine and proceed to Step 9.

[0326] Step 8: Special data processing sub-process.

[0327] Step 8 includes the following sub-steps: Step 8-1: Special record set reception and type identification.

[0328] The special data processing engine receives a special record set and identifies the special type of each record: If the record is "Broken Evidence" → Proceed to Step 8-2.

[0329] If it is other special data → proceed to Step 8-3.

[0330] Step 8-2: Processing of broken records for evidence preservation.

[0331] If data integrity is compromised, a correction factor is generated according to a preset mapping rule and added to the correction factor pool.

[0332] Step 8-3: External special data processing.

[0333] Receive external special data transmitted through a standardized external data interface, including judgment records and / or processing result records returned by external systems, quantify them according to the judgment type / processing conclusion and severity level, generate correction factors or correction factors, and add them to the correction factor pool.

[0334] Step 8-4: Summary of negative signals and output of correction factors.

[0335] All correction factors are aggregated and output to the automated calculation engine.

[0336] Step 9: Post-processing adjustment of engine reception and strategy determination.

[0337] After receiving the preliminary analysis results, the post-adjustment engine performs the following sub-steps: Read the preset configuration policy and determine which sub-engines to enable.

[0338] The corresponding sub-engines are invoked according to the configuration order.

[0339] Step 10A: Insufficient data handling branch.

[0340] If the amount of data in the trusted recordset is lower than the preset threshold (default number of behavioral events is less than 10), the insufficient data processing engine will be invoked. Identify the types of intelligent agents and retrieve the statistical characteristics of mature intelligent agents of the same type.

[0341] Generate the initial baseline.

[0342] The transition coefficient is used to gradually switch from the initial baseline to dynamic evaluation: Final value = (1-γ)×initial baseline + γ×actual calculated value, where γ is a monotonically increasing function of the number of behavioral events.

[0343] Step 10B: Confidence factor correction branch.

[0344] If confidence factor correction is enabled, the confidence factor scoring engine will be invoked: Read the cumulative amount of data of the intelligent agent.

[0345] The confidence level of the analysis results is labeled based on the cumulative amount of data.

[0346] Step 10C: Population localization and population baseline branching.

[0347] If group positioning is enabled, the group relative positioning sub-engine will be invoked: Read the currently accumulated dataset of quantized values ​​of similar intelligent agents from the system.

[0348] Match the corresponding group baseline score based on the combination of dimensions in the query conditions.

[0349] If the group baseline score does not yet exist (when data is insufficient in the early stage of system operation), the quantized value of the agent is stored in the system as the initial baseline data point and marked as "data accumulation".

[0350] If the group baseline score already exists, compare the current agent's quantization value with the group baseline score.

[0351] Calculate the deviation: d = (current quantification value - group mean) / standard deviation.

[0352] Output deviation and relative position.

[0353] In one embodiment, this step further includes: receiving population baseline score data from other trusted analysis nodes through an inter-node data exchange interface, fusing the local population baseline score with the cross-domain population baseline score to generate a global population baseline score, and recalculating the deviation based on the global population baseline score.

[0354] Step 10D: Trend Analysis Branch.

[0355] If trend analysis is enabled, the trend analysis sub-engine will be invoked: Trend trajectories are generated based on the time series analysis results.

[0356] The trend slope is calculated using linear regression with a sliding window.

[0357] The trend direction and level are output based on the preset slope threshold range.

[0358] Step 11: Standardize the output of the reliable analysis signal.

[0359] The post-processing engine summarizes the processing results of each sub-engine and performs the following sub-steps: The credibility quantification value, credibility level, trend label, warning level, group baseline score, deviation, and confidence level are encapsulated into a standardized data format.

[0360] Output standardized and reliable analysis signals.

[0361] In one implementation, the standardized trustworthy analysis signal adopts a fixed field format and includes all preset fields.

[0362] When a sub-engine is not enabled, the fields corresponding to that sub-engine are filled with empty values ​​or preset default values.

[0363] Downstream systems parse the standardized trusted analysis signals according to unified field definitions, without needing to adapt to different signal formats.

[0364] Step 12: Multi-dimensional aggregation and continuous maintenance of the population baseline scores.

[0365] During system operation, the post-adjustment engine continuously performs multi-dimensional aggregation and maintenance of the population baseline scores: After processing the data of a single agent, the system will assign the new quantified values ​​to the corresponding group dataset according to the agent's task type, application scenario, and functional category.

[0366] Each group dataset is maintained independently, and the mean, median, standard deviation, quantiles and other statistics are recalculated each time new data is added.

[0367] The baseline scores for each dimension of the population are persistently stored at a preset period, and the latest baseline data is automatically loaded when the system starts.

[0368] When the population baseline score cannot be generated due to insufficient sample size, the system automatically reverts to the baseline data of the higher-level dimension.

[0369] Step 13: Baseline query service.

[0370] The server provides a standardized baseline query interface that accepts at least one of the following query parameters: task type, application scenario, function category, and level lower limit.

[0371] The server filters out the corresponding agent group based on the query conditions, returns the baseline score data of the group and a list of quantized values ​​of all agents that meet the conditions, along with the sample size label of the group.

[0372] Step 14: Cross-node data synchronization (optional).

[0373] This node synchronizes the generated standardized trusted analysis signal with other trusted analysis nodes according to a preset strategy through a standardized external data interface.

[0374] Meanwhile, this node receives data from other trusted analysis nodes through the interface to enrich and correct the local group reference system.

[0375] Explanation of Evidence Tracing: In all embodiments of the present invention, the system automatically generates an immutable chain of evidence records throughout the entire process of data acquisition, fusion, classification, calculation, adjustment, and output.

[0376] The evidence storage record includes at least the event ID, timestamp, agent identifier, operation type, and hash values ​​of the state before and after the operation, forming a complete audit traceability chain.

[0377] Task authorization configuration instructions: In application scenarios involving behavioral deviation determination, the system retrieves the task authorization configuration that was stored before the task execution from the evidence storage chain as the determination baseline.

[0378] The task authorization configuration includes behavioral constraint parameters for the task, including but not limited to the task completion time window, the list of authorized operation types, and the scope of authorized access resources.

[0379] In this embodiment, when the amount of data in the preliminary analysis result is lower than a preset threshold, a smoothed transition quantized value is generated by the data insufficiency processing sub-engine, which serves as the input benchmark for subsequent sub-engines. After generating the quantized value, the confidence factor sub-engine labels the quantized value with confidence, without changing the quantized value itself. A dynamic group baseline score is generated based on group data of similar intelligent agents. After the dynamic group baseline score is generated, the group relative positioning sub-engine calculates the deviation of the preliminary analysis result from the dynamic group baseline score and outputs a standardized reliable analysis signal without changing the quantized value itself, wherein the standardized reliable analysis signal includes at least the reliable quantized value. When trend analysis is required, the trend slope is calculated by the trend analysis sub-engine without changing the quantized value itself. The outputs of each sub-engine are presented independently in different fields in the standardized reliable analysis signal. When the dynamic group baseline score is generated, the standardized reliable analysis signal also includes the deviation. The system is capable of generating smoothly transitioned quantified values ​​when data is insufficient through a data-insufficient processing sub-engine, providing a stable input benchmark for subsequent sub-engines and avoiding evaluation fluctuations caused by data sparsity. The confidence factor sub-engine independently labels quantified values ​​without altering their numerical values, ensuring the output signal serves as both a quantification result and a reliability reference. When group data meets certain conditions, a dynamic group baseline score is generated, and the deviation is calculated through a group relative positioning sub-engine, providing a relative positional reference within the same group for the evaluation results. The trend analysis sub-engine calculates the trend slope and presents it independently, enabling the signal to contain dynamic information about behavior changes over time. The outputs of each sub-engine are presented independently with different fields, maintaining a clear signal structure without interference. Furthermore, when generating a dynamic group baseline score, the signal also includes deviation, thus improving the dimensional richness, structural stability, and group comparability of the standardized reliable analysis signal while maintaining the consistency of quantified values. This provides a more comprehensive, reliable, and easily interpretable reliable analysis basis for downstream systems.

[0380] Accordingly, the present invention further provides an AI intelligent agent behavior data analysis system.

[0381] Reference Figure 6 , Figure 6 This is a functional block diagram of the first embodiment of the AI ​​intelligent agent behavior data analysis system of the present invention.

[0382] In the first embodiment of the AI ​​agent behavior data analysis system of the present invention, the AI ​​agent behavior data analysis system includes: The trusted data acquisition engine 10 is configured to acquire multi-source behavior records of AI agents from multiple data sources, normalize the format of the multi-source behavior records, read the evidence storage status identifier of each multi-source behavior record, and divide the multi-source behavior records into a trusted record set and a special record set according to the evidence storage status identifier.

[0383] The special data processing engine 20 is configured to receive the special record set and external special data received through a standardized external data interface, and to uniformly convert the special record set and the external special data into a standardized correction factor.

[0384] The automated calculation engine 30 is configured to receive the trusted record set and the correction factor, calculate the performance quantification value and the compliance quantification value based on the trusted record set, correct the compliance quantification value using the correction factor, and generate preliminary analysis results by combining the corrected compliance quantification value and the performance quantification value according to a preset fusion rule.

[0385] The post-adjustment engine 30 is configured to receive the preliminary analysis results, perform post-adjustment on the preliminary analysis results, generate a dynamic group baseline score based on the group data of the same type of intelligent agents when the group data of the same type of intelligent agents meets the preset conditions, calculate the deviation of the preliminary analysis results relative to the dynamic group baseline score, and output a standardized reliable analysis signal. The standardized reliable analysis signal includes at least a reliable quantization value. When the dynamic group baseline score is generated, the standardized reliable analysis signal also includes the deviation.

[0386] The steps for implementing each functional module of the AI ​​agent behavior data analysis system can be referred to in the various embodiments of the AI ​​agent behavior data analysis method of this invention, and will not be repeated here.

[0387] Furthermore, this embodiment of the invention also proposes a storage medium storing an AI agent behavior data analysis program, which, when executed by a processor, performs the operations described in the above-described AI agent behavior data analysis method embodiment.

[0388] Those skilled in the art will understand that all or part of the steps in the methods described above can be implemented by a program instructing related hardware. The program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium is a computer-readable storage medium, including: USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other media that can store program code.

[0389] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0390] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0391] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. An AI agent behavior data analysis method, characterized in that, The AI ​​agent behavior data analysis method includes: The AI ​​agent acquires multi-source behavior records and performs format normalization. The evidence storage status identifier of each multi-source behavior record is read. Based on the evidence storage status identifier, the multi-source behavior records are divided into a trusted record set and a special record set. The special record set and external special data are uniformly converted into standardized correction factors. The performance quantification value and compliance quantification value are calculated based on the trusted record set. The compliance quantification value is corrected using the correction factor. The corrected compliance quantification value and the performance quantification value are then combined according to a preset fusion rule to generate preliminary analysis results. The preliminary analysis results are then adjusted. When the group data of similar intelligent agents meet the preset conditions, a dynamic group baseline score is generated based on the group data of similar intelligent agents. The deviation of the preliminary analysis results from the dynamic group baseline score is calculated, and a standardized reliable analysis signal is output. The standardized reliable analysis signal includes at least a reliable quantization value. When the dynamic group baseline score is generated, the standardized reliable analysis signal also includes the deviation.

2. The AI agent behavior data analysis method of claim 1, wherein, The process involves acquiring multi-source behavior records of the AI ​​agent and normalizing their format, reading the evidence storage status identifier of each multi-source behavior record, dividing the multi-source behavior records into a trusted record set and a special record set based on the evidence storage status identifier, and uniformly converting the special record set and external special data into standardized correction factors, including: Behavior records are collected from multiple data sources, and the behavior records with different input formats are uniformly mapped to the standard behavior record format inside the system. The evidence storage status is identified as complete, broken, or pending verification. Complete evidence-preserving behavior records are classified into the trusted record set, while fragmented evidence-preserving behavior records and evidence-preserving behavior records awaiting verification are classified into the special record set. The stored and verified behavior records are sent to an asynchronous verification queue for asynchronous processing, wherein the asynchronous processing is executed independently of the main process; Obtain the data type and severity level of the special record set and external special data, and generate corresponding correction factors according to the data type and severity level in accordance with preset mapping rules.

3. The AI ​​agent behavior data analysis method as described in claim 2, characterized in that, The process of collecting behavior records from multiple data sources and mapping these behavior records in different input formats to a standardized behavior record format within the system includes: Behavior records are collected from multiple data sources, and the behavior records with different input formats are normalized and uniformly mapped to the standard behavior record format inside the system. When there are conflicting violation types in the behavior records from different data sources, violation type conflict arbitration is performed; When multiple conflicting markers exist, the marker with the highest risk level is selected as the final decision.

4. The AI ​​agent behavior data analysis method as described in claim 2, characterized in that, After sending the stored behavior records to be verified into the asynchronous verification queue for asynchronous processing, the AI ​​agent behavior data analysis method further includes: After asynchronous verification is completed, if the verification result is that the evidence is intact, the corresponding behavior record will be re-included in the trusted record set; if the verification result is that the evidence is broken, the corresponding behavior record will be re-included in the special record set, and the generation of correction factors will be triggered.

5. The AI ​​agent behavior data analysis method as described in claim 1, characterized in that, The process involves calculating performance quantification and compliance quantification based on the trusted record set, correcting the compliance quantification using the correction factor, and then generating preliminary analysis results by combining the corrected compliance quantification and the performance quantification according to a preset fusion rule. This includes: The task completion rate and quality score of the trusted record set are statistically analyzed, and the performance quantification value is calculated using the short board constraint aggregation rule, which is to take the minimum value between the task completion rate and the normalized value of the quality score. Extract violation records from the trusted record set and determine the violation type, using a preset full score as the initial value; A compliance quantification value is obtained by gradient deduction based on the mapping relationship between the violation type and the deduction value, wherein the deduction value is positively correlated with the risk level of the system resource call chain represented by the violation type; The compliance quantification value is corrected using the correction factor, and the corrected compliance quantification value is fused with the performance quantification value through adaptive weighting to generate preliminary analysis results.

6. The AI ​​agent behavior data analysis method as described in claim 5, characterized in that, Before obtaining the compliance quantification value by performing gradient deduction based on the mapping relationship between the violation type and the deduction value, the AI ​​agent behavior data analysis method further includes: Based on the statistical distribution of historical violation data, automatic clustering is used to generate a mapping relationship between each deduction value and each violation type; Alternatively, the system administrator can configure the mapping relationship between each deduction value and each violation type in the compliance management module.

7. The AI ​​agent behavior data analysis method as described in claim 5, characterized in that, The step of correcting the compliance quantification value using the correction factor and then fusing the corrected compliance quantification value with the performance quantification value through adaptive weighting to generate preliminary analysis results includes: The compliance quantification value is adjusted by deducting the correction factor to obtain the corrected compliance quantification value. The performance quantification value and the corrected compliance quantification value are fused using adaptive weighting to generate preliminary analysis results; wherein, when the corrected compliance quantification value is lower than a preset compliance threshold, the weight coefficient of the compliance dimension is automatically increased, and the weight coefficient has an upper limit cutoff value.

8. The AI ​​agent behavior data analysis method as described in claim 1, characterized in that, The preliminary analysis results are then adjusted. When the group data of similar intelligent agents meets preset conditions, a dynamic group baseline score is generated based on the group data of similar intelligent agents. The deviation of the preliminary analysis results from the dynamic group baseline score is calculated, and a standardized reliable analysis signal is output. The standardized reliable analysis signal includes at least a reliable quantization value. When the dynamic group baseline score is generated, the standardized reliable analysis signal also includes the deviation, including: The preliminary analysis results are processed by a post-adjustment engine, which performs at least one of the following post-adjustments, wherein the post-adjustment engine includes at least one of the following sub-engines: a data insufficiency processing sub-engine, a confidence factor sub-engine, a group relative positioning sub-engine, and a trend analysis sub-engine. When the data volume of the preliminary analysis result is lower than a preset threshold, generate a smoothly transitioned quantized value through the insufficient data processing sub-engine, as the input reference for subsequent sub-engines; After generating the quantized value, perform confidence labeling on the quantized value through the confidence factor sub-engine without changing the quantized value itself; Generate a dynamic group baseline score based on group data of homogeneous agents; After the dynamic group baseline score is generated, calculate the deviation degree of the preliminary analysis result relative to the dynamic group baseline score through the group relative positioning sub-engine, and output a standardized credible analysis signal without changing the quantized value itself, wherein the standardized credible analysis signal at least comprises a credible quantized value; When trend analysis is required, calculate a trend slope through the trend analysis sub-engine without changing the quantized value itself; Outputs of all sub-engines are independently presented in different fields in the standardized credible analysis signal; When the dynamic group baseline score is generated, the standardized credible analysis signal further comprises the deviation degree.

9. The AI ​​agent behavior data analysis method as described in claim 8, characterized in that, The step that when the data volume of the preliminary analysis result is lower than a preset threshold, generating a smoothly transitioned quantized value through the insufficient data processing sub-engine as the input reference for subsequent sub-engines comprises: When the data volume of the preliminary analysis result is lower than the preset threshold, obtain the current number of behavior events M through the insufficient data processing sub-engine, and obtain a preset first transition threshold T1 and a preset second transition threshold T2, where T1<T2; When M≤T1, the smoothly transitioned quantized value directly adopts an initial baseline value; When T1<M<T2, the smoothly transitioned quantized value is calculated by the following formula: in, For quantized values, The initial baseline value, This is the actual calculated value. The transition coefficient is a smooth transition coefficient that monotonically increases with M. When M≥T2, the smoothly transitioned quantized value directly adopts an actual calculated value.

10. The AI ​​agent behavior data analysis method as described in claim 8, characterized in that, The step that after generating the quantized value, performing confidence labeling on the quantized value through the confidence factor sub-engine without changing the quantized value itself comprises: After generating the quantized value, generate a confidence factor based on the accumulated data volume, wherein the confidence factor is positively correlated with the accumulated data volume, and the accumulated data volume is the total number of behavior records in the credible record set; When the accumulated data volume is lower than a preset data volume threshold, the confidence factor is lower than a preset confidence threshold; Perform confidence labeling on the quantized value through the confidence factor sub-engine, wherein the confidence labeling is presented as an independent field in the standardized credible analysis signal, without changing the quantized value itself.

11. The AI ​​agent behavior data analysis method as described in claim 8, characterized in that, The step of generating a dynamic group baseline score based on group data of homogeneous agents comprises: Determine an agent group belonging to the same category as the AI agent according to a preset classification strategy, and automatically fall back to baseline data of a higher-level dimension when the sample size of the dimension combination in the query condition is insufficient, wherein the preset classification strategy comprises at least one of the following: classification by task type, classification by application scenario, and classification by function category; Collect historical behavior data of each homogeneous agent from the agent group, and count statistical features of behavior quantized values corresponding to the historical behavior data, wherein the statistical features comprise at least one of a mean value, a median, a standard deviation, and a quantile; A dynamic population baseline score is generated based on the statistical characteristics. The dynamic population baseline score is continuously accumulated and updated as the system runs, so as to form a dynamically evolving reference system. Determine whether the number of similar agent samples under the currently selected combination of classification dimensions meets the preset quantity requirement; When the number of similar intelligent agent samples does not meet the preset quantity requirement, it automatically reverts to the baseline data of the higher dimension.

12. The AI ​​agent behavior data analysis method as described in claim 8, characterized in that, After the dynamic population baseline score is generated, the deviation of the preliminary analysis result from the dynamic population baseline score is calculated by the population relative positioning score engine, and a standardized reliable analysis signal is output without changing the quantization value itself, including: After the dynamic group baseline score is generated, the preliminary analysis result is compared with the dynamic group baseline score through the group relative positioning score engine. The deviation of the preliminary analysis result relative to the dynamic group baseline score is calculated based on the comparison result. The deviation is used to characterize the relative position of the AI ​​agent's behavior level in a group of similar agents. The deviation is output as an independent field to a standardized confidence analysis signal, wherein the quantization value in the standardized confidence analysis signal remains unchanged.

13. The AI ​​agent behavior data analysis method as described in claim 12, characterized in that, After outputting the deviation as an independent field to the standardized reliable analysis signal, the AI ​​agent behavior data analysis method further includes: Through a standardized external data interface, the trusted analysis node corresponding to the standardized trusted analysis signal is synchronized with other nodes according to a preset synchronization strategy, and data from other nodes is received to correct the local reference system. The nodes are interconnected through the standardized data flow interface to form a distributed data processing network, which is used to exchange group baseline data to generate a cross-domain global reference system.

14. The AI ​​agent behavior data analysis method as described in claim 8, characterized in that, When trend analysis is required, the trend slope is calculated through the trend analysis engine without changing the quantified value itself, including: When trend analysis is required, time series analysis result data is obtained through the trend analysis sub-engine. The time series analysis result data is a quantified value sequence of the preliminary analysis result at multiple time points. A trend trajectory is generated based on the time series analysis results, and the trend slope is calculated using sliding window linear regression. The trend direction and trend level are output according to a preset slope threshold range, wherein the trend direction includes at least one of rising, falling or stable. The trend direction and the trend level are output as independent fields to the standardized confidence analysis signal, and the quantized value in the standardized confidence analysis signal remains unchanged.

15. The AI ​​agent behavior data analysis method as described in claim 8, characterized in that, When the dynamic population baseline score is generated, the standardized reliable analysis signal further includes the deviation, including: When the dynamic population baseline score is generated, the standardized credibility analysis signal, in addition to including the credibility quantification value, also fills the deviation field with the deviation degree; wherein, the deviation degree field is one of the preset fields in the standardized credibility analysis signal, and the standardized credibility analysis signal adopts a fixed field format and includes all preset fields; When the dynamic population baseline score is not generated, the deviation field is filled with a null value or a preset value, and the other fields in the standardized confidence analysis signal are unaffected.

16. The AI ​​agent behavior data analysis method as described in claim 8, characterized in that, Before generating dynamic group baseline scores based on group data of similar intelligent agents, the AI ​​agent behavior data analysis method further includes: When the dynamic group baseline score cannot be generated, an individual behavior baseline is generated based on the historical behavior data of the AI ​​agent, and the individual deviation of the preliminary analysis result relative to the individual behavior baseline is calculated. The standardized reliable analysis signal also includes an individual deviation field relative to the individual behavior baseline.

17. The AI ​​agent behavior data analysis method as described in claim 1, characterized in that, The trusted quantification value is a numerical representation of the behavioral level of the AI ​​agent, calculated based on the trusted record set.

18. An AI intelligent agent behavior data analysis system, characterized in that, The AI ​​agent behavior data analysis system includes: The trusted data acquisition engine is configured to acquire multi-source behavior records of AI agents from multiple data sources, normalize the format of the multi-source behavior records, read the evidence storage status identifier of each multi-source behavior record, and divide the multi-source behavior records into a trusted record set and a special record set according to the evidence storage status identifier. A special data processing engine is configured to receive the special record set and external special data received through a standardized external data interface, and to uniformly convert the special record set and the external special data into a standardized correction factor. An automated calculation engine is configured to receive the trusted record set and the correction factor, calculate the performance quantification value and the compliance quantification value based on the trusted record set, correct the compliance quantification value using the correction factor, and generate preliminary analysis results by combining the corrected compliance quantification value and the performance quantification value according to a preset fusion rule. The post-adjustment engine is configured to receive the preliminary analysis results, perform post-adjustment on the preliminary analysis results, generate a dynamic group baseline score based on the group data of the same type of intelligent agents when the group data of the same type of intelligent agents meets the preset conditions, calculate the deviation of the preliminary analysis results from the dynamic group baseline score, and output a standardized reliable analysis signal. The standardized reliable analysis signal includes at least a reliable quantization value. When the dynamic group baseline score is generated, the standardized reliable analysis signal also includes the deviation.

19. An AI intelligent agent behavior data analysis device, characterized in that, The AI ​​agent behavior data analysis device includes: a memory, a processor, and an AI agent behavior data analysis program stored in the memory and executable on the processor, wherein the AI ​​agent behavior data analysis program is configured to implement the steps of the AI ​​agent behavior data analysis method as described in any one of claims 1 to 17.

20. A storage medium, characterized in that, The storage medium stores an AI agent behavior data analysis program, which, when executed by a processor, implements the steps of the AI ​​agent behavior data analysis method as described in any one of claims 1 to 17.

Images